This policy covers every repository under github.com/byjg.

For the PHP components today, that is 6.x and the upcoming 7.0. How the release series work is described in Contributing to PHP components.

Please do not open a public issue. Report it privately on GitHub:

1. Open the repository the vulnerability is in.
2. Go to the Security tab and select Report a vulnerability.

Include what you can of:

• the component and the version affected;
• the runtime -- PHP version, image tag, Node version;
• the steps or a proof of concept that shows the problem;
• the impact: what an attacker can read, change or run.

Security reports take priority over all other work on these projects. You get a reply in the private report thread, and every step until the fix is released happens there, visible to you.

1. The report is confirmed, or questions are asked about it.
2. The fix is prepared privately and released as a patch on the supported versions.
3. A GitHub Security Advisory is published. Packagist and Dependabot read these, so composer audit and dependency alerts warn anyone on an affected version.
4. You are credited in the advisory, unless you prefer not to be.

Details stay private until a fix is released. If a fix is not ready within 90 days, we agree a disclosure date with the reporter.

• Package signing key. The APT and RPM repositories at opensource.byjg.com are signed with the ByJG Opensource key (fingerprint DB84 6CC3 C109 29D3 43B6 B6DC 4BCC 9780 596C 4BCF). A suspected compromise of that key is a vulnerability -- report it in byjg/byjg.github.io.
• Docker images. A CVE in the base image belongs to its upstream project; an issue in what the image adds -- configuration, exposed ports, credentials -- is in scope.
• mcpdocs.byjg.com is public and unauthenticated on purpose: it serves the public documentation. The absence of authentication is not a vulnerability; anything that goes beyond reading that documentation is.