This is the default for every repository of the organisation that has no SECURITY.md of its own; where a repository has one, that one applies.

Please do not report security problems in public issues or pull requests. Report them privately on GitHub: open the repository's Security tab and choose Report a vulnerability. If you cannot use GitHub, write to [email protected].

Say which project and version you used, what you found and how to reproduce it. You get an answer as soon as possible; a fix is published as a new release, and the advisory names you if you like.