This policy covers every WithMarfa repository that does not have its own.

Only the latest release of each repository receives security fixes. If you use an older release, update to the latest one and check whether the problem is still there.

Do not report a vulnerability in a public issue, discussion or pull request.

Report it privately with the Report a vulnerability button on the Security tab of the affected repository. Include what you found, how to reproduce it, and what someone could do with it.

We acknowledge your report and keep you informed while we investigate and fix it, until the fix is released.