This is the default policy for every repository in the kirchDev organization that does not ship a SECURITY.md of its own. A repository's own policy takes precedence.
Please do not file a public GitHub issue for security problems.
Use one of the following private channels:
- GitHub Private Vulnerability Reporting (preferred, where enabled): open the repository's Security tab and choose Report a vulnerability.
- Email: titus.kirch@kirch.dev.
Please include:
- The affected repository, and the file, version or commit.
- A description of the vulnerability and its impact.
- Steps to reproduce.
- Any suggested fix, if you have one.
Never put credentials or personal data into a report.
| Stage | Target timeline |
|---|---|
| Acknowledgement of report | within 3 business days |
| Initial assessment & triage | within 7 business days |
| Fix released (if accepted) | depends on severity — critical issues prioritised |
| Public disclosure & advisory | coordinated with reporter after the fix ships |
Maintained by Titus Kirch / IT-Dienstleistungen Titus Kirch.