Thank you for helping keep Tubrane Group's software and services secure.

We take security seriously and appreciate responsible disclosure of vulnerabilities. If you believe you have discovered a security issue, please report it privately so we can investigate and resolve it before public disclosure.

The following table indicates which versions are currently supported with security updates.

Please do not report security vulnerabilities through public GitHub Issues, Pull Requests, or Discussions.

Instead, report vulnerabilities through one of the approved private communication channels designated by Tubrane Group.

Your report should include, where possible:

• A description of the vulnerability
• Steps to reproduce the issue
• The affected repository or project
• Potential impact
• Proof of Concept (if applicable)
• Suggested mitigation (optional)

The more information you provide, the faster we can investigate and resolve the issue.

After receiving a vulnerability report, we aim to:

1. Acknowledge receipt of the report.
2. Investigate and validate the vulnerability.
3. Determine the severity and potential impact.
4. Develop and test a fix.
5. Release the security update.
6. Notify the reporter once the issue has been resolved.

Response times may vary depending on the complexity and severity of the issue.

We kindly ask that you:

• Allow us reasonable time to investigate and fix the issue.
• Do not publicly disclose vulnerabilities before they have been addressed.
• Avoid accessing, modifying, or deleting data that does not belong to you.
• Avoid disrupting production systems or services.
• Test only within the minimum scope necessary to demonstrate the issue.

We appreciate researchers who follow responsible disclosure practices.

When contributing to Tubrane Group projects, please:

• Keep dependencies up to date.
• Never commit secrets, passwords, or API keys.
• Use environment variables for sensitive configuration.
• Enable Multi-Factor Authentication (MFA) on your GitHub account.
• Follow the organization's secure coding guidelines.
• Report suspected security concerns immediately.

This policy applies to repositories maintained under the Tubrane Group GitHub Organization unless a repository specifies its own security policy.

We appreciate the efforts of security researchers, contributors, and community members who help improve the security of our software and services through responsible disclosure.