Thanks for taking the time to report a potential security problem. A private, well-documented report gives me the best chance to understand the issue and address it without putting other people at risk.

Unless a project says otherwise, security fixes generally target its latest release and default branch. Older releases, archived projects, experiments, and unmaintained repositories may not receive fixes.

Please don’t open a public issue, discussion, or pull request for a suspected vulnerability.

If the repository has GitHub private vulnerability reporting enabled, open its Security tab, choose Advisories, and select Report a vulnerability. That is the preferred route.

If that option isn’t available, use my contact form. In the initial message, identify the affected repository, say that you’re reporting a security issue, and provide a reliable way for me to reply. Please wait until we have a suitable private channel before sending sensitive exploit details or personal data.

When possible, include:

• The affected project, version, branch, or commit
• The type and potential impact of the vulnerability
• Steps to reproduce or a minimal proof of concept
• Any prerequisites or configuration needed to reproduce it
• Whether you know of active exploitation or public disclosure
• A suggested remediation, if you have one

I’ll acknowledge a report when I can, investigate it, and keep you informed of material progress. If the report is valid, I’ll work toward a fix and coordinate disclosure with you. The timing will depend on the project, the severity, and my availability; I can’t promise a specific response or resolution window.

Please give me a reasonable opportunity to investigate before publishing details. I’ll credit reporters who want to be acknowledged, unless doing so would create additional risk.

These projects don’t currently offer a bug bounty or other payment for reports.