Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
main	✅

Reporting a Vulnerability

We take security seriously. If you discover a vulnerability:

Do NOT open a public issue.
Email security reports to simon@puenteworks.com
Include: description, steps to reproduce, impact, suggested fix

Response Timeline

Acknowledgment: Within 48 hours
Initial assessment: Within 5 business days
Fix: Critical 72h, High 7d, Medium 30d

Disclosure Policy

Coordinated disclosure only
Credit given to researchers (unless anonymity requested)
No public disclosure until fix is available

Scope

All repositories under KyaniteLabs and simon on this Forgejo instance.

Last updated: 2026-06-10 Contact: simon@puenteworks.com

There aren't any published security advisories