This document describes how to report security vulnerabilities in failnext.

Security fixes, when released, generally target the latest version of failnext. Backports to older versions are not guaranteed.

Please report suspected security vulnerabilities privately through GitHub's vulnerability reporting.

Do not report security vulnerabilities through public GitHub issues or pull requests.

Include the affected version, steps to reproduce the issue, and its potential impact. Do not include real credentials or secrets.

Reports will be reviewed, and disclosure can be coordinated when appropriate.