If you think you have discovered a security issue in the HieraChain project, I'd love to hear from you. I will take all security bugs seriously and if confirmed upon investigation I will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer.

To report a security bug, file a confidential security bug in the repository's security advisories page. Guidance can be found in the GitHub documentation on privately reporting a security vulnerability.

The process by which security bugs are handled is documented further in the Defect Response process.

When a security report is received, I will:

1. Confirm the issue and assign a severity level
2. Develop a fix and prepare a patch
3. Notify affected users (if applicable)
4. Release the patch and publish a security advisory

For general issues, feature requests, or discussions, please use the regular GitHub Issues. However, please do not report security vulnerabilities through public issues.

If you'd like to contribute code fixes or enhancements, you can submit Pull Requests. For security-related fixes, please coordinate through the security advisories process first before submitting a pull request.

Learn more about the difference between GitHub Issues, Security Advisories, and Pull Requests in the GitHub documentation.