Report vulnerabilities privately through the repository's Security tab → Report a vulnerability (GitHub private vulnerability reporting). Do not open a public issue.

If a repository does not offer private reporting, open a private advisory on hominux/compress4j and name the affected repository.

We aim to acknowledge a report within 5 working days and to ship a fix or mitigation plan within 30 days of confirming it. The advisory credits you unless you prefer otherwise.

Supported versions and guidance for handling untrusted archives are in the Compress4J security policy.