This policy describes how this project handles security. It tells you how to report a vulnerability and what happens after you report it. Our team is committed to the security of the project. We thank the security researchers and users who find and report vulnerabilities.

We support only the latest release of the project, which is the latest GitHub release. Before you report a vulnerability, check that you use the latest version.

We take the security of the project seriously. If you think you found a security vulnerability, follow these steps.

1. DO NOT make the vulnerability public until our team fixes it.
2. We use GitHub Security Advisories for vulnerability reports. Report a vulnerability through GitHub's private vulnerability reporting feature.
3. If you cannot use GitHub Security Advisories, email your findings to tabmadi@proton.me.

Include this information in your report:

• a description of the vulnerability
• the steps to reproduce the issue
• the possible impact of the vulnerability
• any possible fixes you found
• your name or handle, if you want credit for the discovery

After you send a vulnerability report, these steps follow:

1. Acknowledgment: We confirm that we received your report within 48 hours.
2. Verification: Our team checks the vulnerability and its impact.
3. Updates: We send you regular updates during our investigation.
4. Resolution: When we confirm the vulnerability, we work on a fix. We agree the disclosure timeline with you.

• The vulnerability stays private until a fix is ready.
• When a fix is ready, we release it as soon as possible.
• After the release, we make the vulnerability public. We also name the reporter, if the reporter wants this.
• Our target is to fix a vulnerability and release the fix within 90 days of the report.

We release security updates in these ways:

1. For a critical vulnerability, we release a patch as soon as possible.
2. For a less severe issue, the fix can go into a regular release.
3. The release notes show when a release includes security fixes.
4. We tell users through our regular communication channels.

To keep your installation secure:

1. Always use the latest version of the project.
2. Apply security patches quickly.
3. Follow the security best practices for your programming language and environment.
4. Check your dependencies for known vulnerabilities at regular intervals.
5. Use correct access controls and authentication mechanisms.
6. Use secure communication protocols, such as HTTPS and SSH.

Change this section to match the security configuration of your project:

• the recommended security settings
• the configuration options that make the project more secure
• examples of a secure configuration

We state the known limits of our security measures openly:

• the known security limits
• the planned security enhancements
• the areas that need extra care

To ask about security or to report a vulnerability, contact:

• Security Email: tabmadi@proton.me
• Project Maintainer: tabmadi@proton.me

Replace these with your real contact information.

We thank these people, who disclosed security vulnerabilities responsibly:

• This list grows when contributors report security issues

This security policy changes when needed. Last updated: 2026-05-16.