Thank you for helping keep CloudBlue's projects and their users safe.

Please don't report security issues in public issues, pull requests or discussions.

1. Preferred: open the repository on GitHub, go to the Security tab and choose Report a vulnerability. The report stays private between you and the maintainers. (How it works)
2. If the repository has no Report a vulnerability button, email security@cloudblue.com.

Please include:

• the project and version (or commit) affected;
• what an attacker could do, and the steps or a proof of concept to show it;
• any fix or workaround you know of.

• We aim to confirm that we received your report within a few working days.
• We investigate, keep you updated, and tell you when a fix is ready.
• We credit you in the advisory and release notes, unless you'd rather stay anonymous.
• Please give us a reasonable time to release a fix before you disclose the issue publicly. We will agree on a date with you.

We fix security issues in the latest release of each maintained project. Archived repositories are no longer maintained and don't receive fixes.

This policy covers the open-source code in the cloudblue GitHub organization. For CloudBlue products and services themselves, use the same contacts; we will route your report to the right team.