Project Continuum is pre-1.0. Security fixes are made against the latest release of each repository. Please reproduce the issue on the latest release before reporting it.

Please don't report security vulnerabilities in public issues, discussions or pull requests.

Use one of these private channels:

1. GitHub private vulnerability reporting (preferred). Open the repository's Security tab, choose Report a vulnerability, and fill in the form.
2. Email projectdevcontinuum@gmail.com with the subject Security: <repository name>.

Please include:

• the affected repository, version and component
• a description of the issue and its impact
• steps to reproduce, or a proof of concept
• any suggested fix

• We aim to acknowledge your report within 3 working days.
• We will keep you updated while we investigate and tell you when a fix is released.
• We credit reporters in the release notes unless you prefer to stay anonymous.

Please give us a reasonable time to fix the issue before disclosing it publicly.

This policy covers all repositories in the projectcontinuum-org organization and the container images published to Docker Hub under projectcontinuum. Vulnerabilities in third-party dependencies should be reported to their maintainers, but let us know if Continuum is affected.