This policy covers every Deckyard repository that has none of its own.

Report it privately through the repository's Security tab, with Report a vulnerability. Do not open a public issue.

Include the deck and its version, the Jennifer version (jennifer version), and the smallest input or program that shows the problem.

The deck's maintainers answer the report. If they do not answer within two weeks, an organisation owner does. A fix is released as a new version of the deck, and the advisory is published once that version is available.

A deck's own code and documentation. A problem in the Jennifer interpreter or its standard library belongs to the Jennifer project; report it there.