This policy applies to every repository under @Nadimul96 unless a repository has its own SECURITY.md.

Please report vulnerabilities privately. Do not open a public issue, discussion or pull request.

• Preferred: use GitHub's private vulnerability reporting from the repository's Security tab (Report a vulnerability), when it is enabled.
• Otherwise: email nadimul96@gmail.com with "security" in the subject.

Include the affected repository and commit, what an attacker could do, and the steps to reproduce. A proof of concept helps but is not required.

These are personal projects maintained by one person, so there is no formal SLA. You can expect an acknowledgement within a few days, an assessment of whether the report is in scope, and credit in the fix or advisory if you would like it.

Only the latest commit on main is supported. Fixes are not backported.