This policy covers every public project under CMaintz that does not have its own SECURITY.md.

Please do not open a public issue. Report it privately through GitHub instead: open the project's Security tab and choose Report a vulnerability. Describe what you found, how to reproduce it, and what an attacker could do with it.

These are one-person projects, so expect a reply within a week. We will agree on a fix and a disclosure date with you, and credit you in the advisory unless you would rather not be named.

If private reporting is not available on a project, open an issue that says only "security contact wanted", without details, and you will be contacted.

Only the latest release (or the default branch, for projects without releases) receives security fixes.