Please do not report security issues in public issues, PRs, forums or Discord.

Report privately via either:

• GitHub: Security → Report a vulnerability on this repository (private advisory), or
• email: security@ahwoo.com

Please include the affected packages and versions, a description of the issue and its impact, and steps or code to reproduce it.

• We'll acknowledge your report within 5 working days (NZ time).
• We'll keep you updated while we investigate, and agree a disclosure timeline with you.
• We're happy to credit you in the advisory unless you'd prefer not to be named.

Security fixes are made to the latest released version of each BRUTAL package on NuGet. Please update before reporting if you can.

In scope: BRUTAL source and packages in this repository. Out of scope: issues in third-party libraries we bundle (report those upstream; see LICENSES/), and in games built with BRUTAL (contact that game's developer).