Please do not report security vulnerabilities in public issues or pull requests.

Report them privately by email to morf3089@gmail.com, with a description, the affected version and configuration, and steps to reproduce. You will receive an acknowledgement within 3 days and an initial assessment within 14 days; we then coordinate a fix and disclosure timeline with you.

The full policy, including how vulnerabilities are handled, is in the openartifact SECURITY.md.