Do not report security issues in public issues, pull requests or discussions. Report them privately, so the issue can be fixed before it is disclosed.
Use one of these channels:
- the Report a vulnerability button on the repository's Security tab (preferred)
- email to [email protected]
Include the affected version, the relevant part of the configuration, steps to reproduce, and the impact you observed.
We acknowledge a report within 7 days.
Published advisories and the full policy are at yarilomail.org/security.