Security policy
SECURITY.md
How to report a suspected vulnerability without exposing it publicly.
When to use it
Read this before reporting a suspected vulnerability or sharing a security proof of concept.
- Do not open a public issue for a suspected vulnerability.
- Use GitHub private vulnerability reporting for confidential coordination; use security@luastra.dev if that route is unavailable.
- Include the exact version or commit, affected hosts, safe reproduction steps, expected impact, and known preconditions.
- Never include real credentials, personal data, production tokens, or unrelated private source.