DiscVault provides security updates for the most recent published v26 release. Users should update to the latest release before reporting an issue that may already have been resolved.

Please report suspected vulnerabilities privately. Do not open a public GitHub issue, discussion, or pull request for an undisclosed security vulnerability.

Use one of these confidential reporting channels:

1. Report a vulnerability privately through GitHub (preferred).
2. Email [email protected] with the subject DiscVault security vulnerability.

Include as much of the following information as possible:

• the affected DiscVault version and deployment environment;
• the vulnerability type and potential impact;
• clear reproduction steps or a minimal proof of concept;
• relevant logs, screenshots, or configuration details, with secrets and personal data removed;
• any known mitigations or workarounds;
• whether and how you would like to be credited.

Please avoid accessing, changing, or deleting data that does not belong to you, disrupting services, or exploiting a vulnerability beyond what is necessary to demonstrate it.

• We will acknowledge receipt within 7 calendar days.
• We may ask for additional information while validating and assessing the report.
• We will provide a status update at least every 14 calendar days until the report is resolved or closed.
• If we accept the report, we will coordinate remediation and public disclosure with you. Please keep the vulnerability confidential until we agree that it can be disclosed.
• If we decline or close the report, we will explain why when it is practical and safe to do so.

Remediation timelines depend on severity, complexity, and the risk of exploitation. Confirmed vulnerabilities are prioritized according to their impact and may be disclosed in a GitHub Security Advisory and the project release notes after a fix is available.