Security Reporting

If you find a vulnerability in astrapatch itself, or in this website, please report it privately rather than opening a public issue.

How to report

Use GitHub's private vulnerability reporting on the project repository ("Report a vulnerability" under the Security tab).

Please include:

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• Affected versions or commits, if known.

What to expect

Reports are acknowledged as soon as practical, investigated, and fixed in coordination with the reporter. Please allow reasonable time for a fix before public disclosure.

Scope

This policy covers the astrapatch framework and the astrapatch.online website. Vulnerabilities found using astrapatch in third-party software should be reported to that software's maintainers.