Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

Email security findings to letterbox@oss.joefang.org.
If details are sensitive, encrypt the report using the PGP key published at https://joefang.org/pgp (Fingerprint: 1CA3 EB47 A7FC BCF9 F28D 4346 B522 8030 A919 B27A).
Avoid filing public issues with exploit details; coordinate disclosure privately first.

What to Include

A concise description of the issue, affected components or file paths, and minimal steps to reproduce.
Any logs or screenshots that help explain the impact (omit secrets and personal data).

After You Report

Reports will be acknowledged via email. Coordination and remediation timelines may vary based on severity and complexity.

There aren’t any published security advisories