Please do not report security vulnerabilities through public GitHub issues, pull requests or discussions.

Report them privately using GitHub's private vulnerability reporting, which is enabled on this repository. The report is only visible to you and the thin-edge.io maintainers, and the follow-up discussion happens in the comment thread of the resulting draft advisory.

The Reporting a Vulnerability documentation describes what to include in a report and what happens after you submit one.

This policy covers the software published from this repository. It does not cover community plugins and other community extensions, including those hosted under the thin-edge organization, which are maintained independently. Report a vulnerability in a community project to the maintainers of that project.

Advisories are published on the security advisories page of this repository, and announced in the Tech Community under the tedge-security tag, together with emergency releases and safety guidance.

See Security Advisories for details.