We take the security of this project seriously and appreciate responsible disclosure.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, please report vulnerabilities privately via GitHub Security Advisories:

1. Go to the Security tab of this repository.
2. Click "Report a vulnerability".
3. Provide as much detail as you can — a description of the issue, steps to reproduce or a proof of concept, the affected version(s), and any suggested remediation.

We will acknowledge your report within 10 business days, keep you informed as we investigate, and credit you in the resulting advisory if you wish (or keep your report anonymous — your choice).

Security fixes are applied to the latest released version. We encourage all users to stay on the most recent release.

This policy covers the code in this repository. For security issues concerning the Elementary Cloud platform, please contact us through your Elementary support channel instead of this repository.

Once a report is confirmed:

1. We develop and test a fix privately.
2. We release a patched version.
3. We publish a GitHub Security Advisory describing the issue, affected versions, and the fixed version, crediting the reporter (with their consent).

Thank you for helping keep Elementary and its users safe.