This policy covers the awesome-go repository itself: the static site generator, the CI/CD workflows, and the rest of the tooling and configuration in this repo.

awesome-go is a list of links to third-party projects. If you find a vulnerability in a listed library or tool, report it to that project's maintainers, not here. If a listed project is malicious or compromised (for example, the repository was taken over), please report it privately using the steps below so we can remove the link.

This is a community-maintained open source project provided as-is. There are no versioned releases. Only the current main branch and the site published from it are covered.

Please do not open a public issue or pull request for security problems.

Report it privately through GitHub instead:

1. Go to the Security tab of this repository.
2. Click "Report a vulnerability", or go straight to https://github.com/avelino/awesome-go/security/advisories/new.
3. Fill in the form.

Only the maintainers can see the report. Please include:

• a description of the problem and where it is (file, workflow, or URL)
• steps to reproduce, if you have them
• the impact you expect
• a suggested fix, if you have one

We'll reply in the advisory as soon as we can. The maintainers do this in their free time, so please give us a reasonable window to fix the problem before you disclose it publicly.

Fixed security issues are published as security advisories once they're resolved.