Do not report vulnerabilities through public issues or discussions.

Use GitHub's private vulnerability reporting for this repository. Open the Security tab, select Advisories, and choose "Report a vulnerability". If the button is not available, wait until a private reporting channel is listed here rather than publishing technical details.

Include, where possible:

• the affected application entry, recipe, or generated configuration;
• the conditions and steps needed to reproduce the issue;
• the security impact and affected versions;
• a minimal, non-destructive proof of concept;
• any suggested mitigation.

Do not include real credentials, personal data, or data taken from systems you do not own or have permission to test.

This policy covers catalog data, Docker Compose recipes, proxy examples, installation instructions, and backup, restore, and smoke-test scripts in this repository. Report a vulnerability in an upstream application to that application's security team unless a Fossary recipe or instruction introduces or materially increases the risk.

The project has no bug bounty program. Good-faith, non-destructive research and coordinated disclosure are welcome.