Security

How to report a vulnerability in weft.

Please report vulnerabilities privately, never in public issues or pull requests.

1. Preferred: GitHub private vulnerability reporting. Open the affected repository under github.com/theweft, go to the Security tab and click Report a vulnerability. The report stays private until a fix is published.
2. If you cannot use GitHub: email security@theweft.org.

Please include a description, affected versions and, if possible, steps or an input that reproduces the problem. We acknowledge reports within 3 working days and coordinate disclosure with you. Reporters are credited in the advisory unless they prefer otherwise.

Only the latest release receives security fixes until a long-term support policy is published.