This policy applies to every repository of the nipscernlab organization that does not have its own SECURITY.md.

Do not open a public issue, discussion or pull request for a vulnerability.

Report it privately through GitHub: on the repository page, open the Security tab and choose "Report a vulnerability". The report is visible only to the maintainers of the repository.

If you cannot use GitHub, or private reporting is not available in the repository, write to contact@nipscern.com with "Security" in the subject.

Include what you found, the version or commit affected, how to reproduce it, and what an attacker could do with it.

We acknowledge the report, confirm or reject it, and agree with you on when the fix and the disclosure are published. Fixes are released in the supported versions below and credited to the reporter unless the reporter asks otherwise.

Only the latest release of each project receives security fixes, unless the repository says otherwise.

If you find a password, token, key or other credential in one of our repositories, report it the same way. Do not use it.