Do not open a public issue for security vulnerabilities.

Use GitHub's private vulnerability reporting in the affected repository:

1. Open the affected repository under https://github.com/php-forge/<repository>.
2. Go to the Security tab.
3. Click Report a vulnerability and describe the issue, how to reproduce it, its impact and any suggested fix.

See Privately reporting a security vulnerability.

If the Report a vulnerability button is not available in a repository, open a public issue that only asks for a private contact. Do not include vulnerability details in it.

Security fixes are applied to the latest stable release of each package unless the repository documents a different support policy. Older and development versions receive no security updates, although reports about them are welcome.

This project is maintained on a best-effort basis. Reports are reviewed as maintainer availability permits; receipt is acknowledged and updates are given through the private report. No acknowledgment, assessment or remediation deadline is guaranteed. Please do not include vulnerability details in public issues or discussions.

This policy applies to all repositories under the php-forge organization.