This policy covers every repository in the carbonmeai organization that does not have a security policy of its own. danwo has its own.

Please do not report security problems in public issues, discussions or pull requests.

Report them privately through GitHub: open the affected repository's Security tab and choose Report a vulnerability. Include what you found, how to reproduce it, and what an attacker could do with it.

You will get an acknowledgement within three working days. We will keep you informed while we fix it, agree a disclosure date with you, and credit you in the advisory unless you would rather we didn't.

Some repositories here are forks of other projects. If the problem is in the original project's code, please report it there as well, so every user of that project gets the fix.

Fixes land on the latest release, or on the default branch for repositories without releases.