SECURITY.md

Only the latest minor version releases are supported (>= 0.13) for accepting vulnerability reports and patching fixes.

Existing vulnerability reports are being tracked inGitHub Security Advisories.

1. Report an advisory for the vulnerability.
   • Please be aware thatonly advisories reported in plain English will be reviewed.
2. Project maintainers review the advisory:
   • Ask clarifying questions
   • Make sure there was no prior advisory exists for the same vulnerability
   • Confirm or deny the vulnerability
3. Once the advisory is accepted, the reporter may submit a patch or wait for project maintainers to patch.
   • The latter is usually significantly slower.
4. Patch releases will be made for the supported versions.
5. After 14 days of the release, publish the corresponding advisory onGitHub Security Advisories.

Thank you for making open source community a better place!