This policy applies to every repository in the Second Wind OSS organization that does not carry its own SECURITY.md. A repository's own file takes precedence.

The latest release of each project receives security fixes. Older releases do not.

Report vulnerabilities privately through GitHub's private vulnerability reporting: open the Security tab of the repository concerned and choose "Report a vulnerability". Do not open a public issue for a security problem.

You will get a reply within a week. If the report is confirmed, the fix ships in the next release together with an advisory that credits you unless you prefer otherwise.