This is the default policy of the TinyGears organization. It applies to every repository that does not have a SECURITY.md of its own.

The latest release of a project, or its main branch if it has no release yet, receives security fixes. Projects listed as earlier projects in the organization profile are not developed any more and receive none.

Do not open a public issue. Report it privately, in one of two ways:

• through GitHub's private vulnerability reporting of the affected repository (the Security tab, "Report a vulnerability"), where the repository has it enabled, or
• by email to security@tinygears.org.

Include the project and version, a minimal reproduction and the impact you see. Reports are answered on a best-effort basis, and a fix is released before the details are published.