This policy covers every public repository under rustfuture.

Only the latest release of each project gets security fixes.

Please do not open a public issue. Use the Report a vulnerability button in the repository's Security tab. The report stays private between you and the maintainer.

Include the version or commit, what an attacker can do, and steps or a file that reproduces it.

• Acknowledgement within 7 days.
• A fix or a decision within 30 days, with updates in the private report.
• Coordinated disclosure: once a fixed release is out, the report can become a public advisory that credits you, unless you prefer not to be named.