This policy applies to every Brainwires repository that doesn't have its own SECURITY.md.

Report it privately through GitHub on the affected repository: open its Security tab and choose Report a vulnerability. Please do not open a public issue, discussion or pull request about it.

Include as much as you can: the version or commit, the platform, the steps to reproduce, and the impact you see.

If a repository is a fork (for example our forks of Deno or rusty_v8) and the issue is also in the upstream project, report it to us the same way. We forward it privately to the upstream maintainers and coordinate the fix and disclosure with them.

• We acknowledge a report within 3 business days and triage it within 7.
• We aim to release a fix within 90 days, sooner when the issue is being exploited.
• We publish a GitHub security advisory for every confirmed issue in a released version, and credit you unless you'd rather stay anonymous.

• Don't access, change or delete data that isn't yours, and don't degrade anyone's service.
• Don't publish or share the issue until a fix is released.
• Act in good faith. If you follow this policy, we won't take legal action against you over your report.