The modules published under thelia-modules follow the Thelia security policy.

Never report a security problem through a public issue, discussion or pull request. Report it privately, in one of two ways:

• open a private report from the Security tab of thelia/thelia, naming the module and its version,
• or email contact@thelia.net with [SECURITY] in the subject line.

A security fix ships in a new release of the affected module. Keep each module on the latest release of the line that matches your Thelia version.