Organization-default security policy for all OSS and FOSS projects, as defined in On Openness in the organization profile.

Security fixes ship on the latest default branch only; other tags and branches are supported on a best-effort basis.

Report a suspected vulnerability in a public repository exclusively through that repository's private vulnerability reporting, under its own security policy where one exists; otherwise, under this default policy. Do not open a discussion or disclose details in any public venue. If the facility is unavailable, write to contact[at]rebis[dot]cn to request a reporting channel, providing only a minimal, non-sensitive summary; provide exploit details only on request.

A useful report states: the issue and its potential impact; reproduction steps, with a minimal reproducible example where possible; affected version or commit SHA, platform, and toolchain; any suggested mitigation or fix.

1. Acknowledgement within seven business days.
2. Investigation and confirmation; a coordinated-disclosure timeline is then agreed with the reporter.
3. Fix developed and merged privately.
4. Security advisory published, crediting the reporter unless anonymity is requested.

Non-security matters belong elsewhere: technical matters to organization Discussions, other private matters to contact[at]rebis[dot]cn, per the applicable contributing guide.