Please don't report security problems in public issues, pull requests or on Discord. Contact us privately through our contact page instead.

How quickly we reply depends on the channel you use. If the problem is urgent, contact several maintainers at the same time, including ones who don't seem to work on the affected part.

We usually confirm we've received a report within 3 days, and send our assessment and a plan for fixing it within 2 weeks. Please keep the problem private until it's fixed. Once it is, we'll credit you, unless you'd rather we didn't.

You don't need to work out the scope or the affected versions before writing to us. Euterpe is a small project, and we'd rather look into a false alarm than miss a real problem.

We don't have a bug bounty. In exceptional cases we may decide to offer a reward.