Do not report security issues in public issues, pull requests or discussions. Report them privately, so the issue can be fixed before it is disclosed.

Use one of these channels:

• the Report a vulnerability button on the repository's Security tab (preferred)
• email to security@yarilomail.org

Include the affected version, the relevant part of the configuration, steps to reproduce, and the impact you observed.

We acknowledge a report within 7 days.

Published advisories and the full policy are at yarilomail.org/security.