Only the latest release of Gearberg receives security fixes.

Please do not open a public GitHub issue for security vulnerabilities.

Use GitHub Private Vulnerability Reporting to disclose a vulnerability confidentially.

Include as much detail as possible:

• A description of the vulnerability and its impact
• Steps to reproduce or a proof-of-concept
• Any suggested mitigations

We will acknowledge your report within 5 business days and aim to release a fix within 30 days of confirmation. We will credit you in the release notes unless you prefer to remain anonymous.