We take the security of this project seriously.

• Primary Channel: If you discover a sensitive security vulnerability, please report it privately through GitHub (sign-in required). Please do not open public GitHub Issues or public Discord threads for security vulnerabilities.
• Secondary Channel: For sensitive matters where GitHub Advisories are not feasible, you may Direct Message (DM) the maintainers on our Discord server.

For urgent but non-sensitive matters, general questions, and immediate assistance requests, please reach out to our community Discord Channel: https://discord.gg/uFgha7Kb6n.

Coordinate sensitive fixes through the private reporting channel before opening a public pull request, which could disclose the vulnerability.

When contributing a security fix, please ensure that your contribution is accompanied by ample testing to prevent future regressions. Follow the guidelines outlined in our CONTRIBUTING.md guide for testing and development setup.

Floppy does not currently publish a security support window or an older-release backport policy. Do not assume older tags receive security fixes. Check the release notes and the deployed image's source revision when assessing whether a fix is installed; a source change alone does not update a published image.

No response-time guarantee is published. Include the affected version or image digest, reproduction steps, and impact in a private report. If GitHub reporting is unavailable, use the maintainer DM fallback above.