This policy covers ntindle's public repositories that don't have a security policy of their own. GitHub shows it in each of them.
Please report security problems privately, not in a public issue, pull request or discussion.
- Open the repository's Security tab and choose Report a vulnerability. The report stays private, and we can work on the fix together in a private security advisory.
- If a repository doesn't offer that button, open an issue that only asks for a private way to reach me. Leave the details of the problem out of it.
- If the repository is a fork, the code belongs to another project, so please report it to that project instead.
I'll reply as soon as I can. These are personal projects, so it may take a few days. Once a fix ships, I'll credit you in the advisory unless you'd rather I didn't.
Only the latest commit on each repository's default branch gets security fixes.