Report vulnerabilities through GitHub private advisories. If you cannot use GitHub, email contact@ownima.com.

Please include:

• affected repository and version or commit;
• steps to reproduce;
• impact you believe it has;
• any suggested fix.

Do not open a public issue for a vulnerability. We aim to acknowledge a report within two working days and to keep you updated until it is resolved.

Only the latest release of each released service is supported. Fixes land on main; where Release Please is configured, they ship in the next release.