This policy applies to every MustrHQ repository that does not have its own SECURITY.md.

Please do not open a public issue for security problems. People self-host MustrHQ, so a public report leaves every unpatched installation exposed while the fix is written.

Report privately with GitHub's private vulnerability reporting — the Security → Report a vulnerability button on the affected repository — or by email to team@sparkx.digital.

Please include the version you tested, the page or file affected, steps to reproduce, and what an attacker could achieve.

You will get an acknowledgement within a few working days. Fixes ship in a new release, and you are credited in the release notes unless you would rather not be.

Security fixes are made for the latest release of each application.