This policy covers every public StructuPath repository that does not have its own SECURITY.md.

Please do not report a security problem in a public issue, pull request or discussion.

Report it privately through GitHub instead: open the affected repository's Security tab and choose Report a vulnerability. Only the maintainers can see the report.

A useful report includes:

• the repository and the version or commit affected
• what an attacker could do with it
• the steps to reproduce it

Security fixes go into the latest release on the default branch.