This policy covers every PhilaCon Valley repository that has no SECURITY.md of its own.

Do not open a public issue, pull request, or Discord post about a security flaw. A public report shows the flaw to everyone before we can fix it.

Report it privately, in one of two ways:

1. On GitHub (preferred). Open the repository's Security tab. Click Report a vulnerability. Only the maintainers can see your report.
2. By email. Write to waskar@philaconvalley.com.

In your report, include:

• What the flaw is, and where it is.
• The steps to make it happen.
• What an attacker could do with it.

• We confirm that we received your report within 48 hours.
• We work with you on a fix before anyone discloses the flaw in public.
• When the fix is out, we credit you in the advisory, unless you ask us not to.

We support only the latest code on main, and the latest live deployment where one exists. Test against those.