Security policy

This is the default policy of the TinyGears organization. It applies to every repository that does not have a SECURITY.md of its own.

Supported versions

The latest release of a project, or its main branch if it has no release yet, receives security fixes. Projects listed as earlier projects in the organization profile are not developed any more and receive none.

Reporting a vulnerability

Do not open a public issue. Report it privately, in one of two ways:

• through GitHub's private vulnerability reporting of the affected repository (the Security tab, "Report a vulnerability"), where the repository has it enabled, or
• by email to security@tinygears.org.

Include the project and version, a minimal reproduction and the impact you see. Reports are answered on a best-effort basis, and a fix is released before the details are published.