This policy applies to every StudentSuite repository that does not have its own SECURITY.md.

Report privately. Do not open a public issue, discussion, or pull request about it.

1. If the affected repository has private vulnerability reporting enabled, use its Security tab, then Report a vulnerability.
2. Otherwise, email studentsuite3@gmail.com with the repository name.

Include what the problem is, how to reproduce it, and what an attacker could do with it. A suggested fix is welcome but not required.

• We acknowledge the report within 48 hours.
• We investigate within a week and keep you updated.
• We fix it, then disclose it, crediting you unless you would rather not be named.

Unauthorized access to data, authentication or authorization bypasses, injection or code execution, and information disclosure in StudentSuite code or sites.

Social engineering, denial of service, physical attacks, and bugs in third-party services or dependencies, which should go to their maintainers.