Security and responsible disclosure are core to the 9gkc project portfolio. This policy explains how to report a suspected vulnerability without exposing users, maintainers, or third-party systems to unnecessary risk.

The default branch of each repository is the supported version unless that repository documents a different support window. Older releases may not receive fixes unless a release page explicitly says otherwise.

Please do not open a public issue for a suspected vulnerability. Use GitHub’s private vulnerability reporting feature from the repository’s Security tab when it is available. If private reporting is unavailable, contact the repository owner through the @9gkc GitHub profile or email and use a subject that clearly indicates a private security report.

A useful report should include the affected repository and version or commit, a concise description of the impact, reproducible steps within an authorized environment, relevant logs or screenshots with secrets removed, and a safe way to follow up. Please keep the report focused and avoid sharing information that is not necessary to verify the issue.

Do not send passwords, API keys, private tokens, personal data, production secrets, destructive proof-of-concept payloads, or instructions for accessing systems outside the approved scope. Do not test against third-party services or other users’ accounts.

Reports are reviewed in good faith and handled as quickly as practical. The review may include confirmation of the affected behavior, impact assessment, a remediation plan, and a coordinated release or advisory where appropriate. Please allow reasonable time for validation before making a report public.

Security testing must be performed only with explicit authorization and within a defined scope. The existence of a tool or documented technique in these repositories does not grant permission to use it against any system.