Do not open a public issue or discussion containing vulnerability details, credentials, personal data, or production configuration.

Use Report a vulnerability from the affected repository's Security page when private vulnerability reporting is available. Otherwise, email me@yorunoken.com with the subject Hanami security report.

Include, when available:

• the affected project, version, or URL
• the impact and who may be affected
• reproduction steps or a minimal proof of concept
• suggested mitigations
• whether the issue has been disclosed anywhere else

If a credential may have been exposed, revoke or rotate it before sending the report. Do not include active secrets in the report.

Security fixes target current default branches, current releases, and actively deployed Hanami services. Older versions are evaluated case by case.

Please allow maintainers time to confirm the report, prepare a fix, and coordinate disclosure. Hanami will credit reporters when requested and appropriate.