This policy applies to every public repository in the Middle-Systems organization that doesn't ship its own SECURITY.md.

Please don't open a public issue or pull request for a security problem.

Preferred: use GitHub's private reporting. Open the Security tab of the affected repository and choose Report a vulnerability.

If that isn't available, email vulnreport@middlesystems.net with:

• the repository and version or commit affected
• steps to reproduce, or a proof of concept
• what you believe the impact is

• We aim to acknowledge reports within 5 business days.
• We'll keep you updated as we investigate and let you know when a fix is released.
• If you'd like credit for the report, tell us how you'd like to be named.

In scope: code in this organization's public repositories.

Out of scope: client systems and infrastructure, third-party services, and social engineering or physical attacks. If you've found a problem in a dependency, please report it upstream.

Unless a repository says otherwise, only the latest release or the default branch receives security fixes.