This policy applies to every repository in the gatepost-dev organisation that has no security policy of its own.

No package is released yet. After the first release, we fix security problems in the newest minor version of each package.

Report each problem privately. Do not open a public issue.

1. Open the affected repository on GitHub, and open its "Security" tab.
2. Select "Report a vulnerability".
3. Describe the problem, the affected package and version, and the steps to reproduce it.

Only the maintainers can read the report.

• We reply within 3 working days.
• We confirm the problem and agree on a disclosure date with you.
• We aim to release a fix within 30 days for a high or critical problem.
• We credit you in the release notes, unless you ask us not to.

This policy covers Gatepost code only. Report a problem in NIPOST's own systems to NIPOST, through the contact details on its official website. Do not test NIPOST's systems. NIPOST's acceptable use policy forbids probing them.