This is the default security policy for openctemio repositories that do not have their own.

Do not open a public GitHub issue, pull request or discussion for a vulnerability. Report it privately:

• email security@openctem.io; or
• GitHub private vulnerability reporting: Security → Report a vulnerability on the affected repository.

Include the affected repository and version (or commit), the impact, reproduction steps or a proof of concept, and how you would like to be credited.

Test only against systems you own or are authorised to test. Response targets, scope and the full disclosure policy are in the OpenCTEM security policy.