If you believe you've found a security vulnerability in a Zenstruck repository, please do not open a public issue.
Instead, report it privately using GitHub's private vulnerability reporting form for the relevant repository.
In the affected repository:
- Open the Security tab.
- Choose Report a vulnerability to submit a private disclosure.
Please include as much information as possible, including:
- A clear description of the issue
- Steps to reproduce
- A proof of concept, if available
- The affected repository, version, branch, or commit
- Any suggested mitigations or fixes
We will review reports as quickly as possible and work to validate and address legitimate issues.
This policy applies globally to repositories in the Zenstruck organization unless a repository includes its own SECURITY.md, which takes precedence.