A repository with a different disclosure process can ship its own SECURITY.md, which overrides this org-wide default.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report them privately through GitHub's private vulnerability reporting:

1. Open the Security and quality tab of the affected repository.
2. Click Report a vulnerability and complete the advisory form.

If private reporting is not available for a repository, email security@melodicsoftware.com instead.

Please include enough detail to reproduce and assess the issue (affected repository and version, impact, and reproduction steps). We will acknowledge your report in the advisory thread, or by reply if you emailed it, and post progress there as we investigate and address it.

Security fixes are applied to the latest released version on the default branch. Older versions are not maintained unless a specific repository states otherwise.