This repository holds the organisation's shared GitHub configuration. The policy below covers every repository under the organisation, not only this one.

Report through GitHub private vulnerability reporting on the repository concerned, or through the owner's published GitHub profile contact method. Do not open a public issue for a vulnerability, and do not include credentials, account identifiers, private session data or customer records in a report.

Include the repository, the affected version or commit, the impact you observed, and the smallest reproduction that still shows it. Redact anything that is not needed to reproduce.

A report about a documentation repository or a shared workflow is in scope when it would let someone change what a build or a published document says. A report about a live deployment belongs with the repository that owns the deployment; that repository's own policy names where its credentials live and how they are rotated.

The maintainer acknowledges a report on a best-effort basis and coordinates the fix and the disclosure timing with you. There is no bounty and no guaranteed response time.