# Security policy

## Reporting a vulnerability

If you discover a security issue, please send a GPG-encrypted email to the maintainers using the following keys:

- [`0x1C3724DFF9CEAF64`](https://keys.openpgp.org/vks/v1/by-fingerprint/46C4ACD8B7B3F77DC8C2E8ED1C3724DFF9CEAF64) ([b5327157@protonmail.com](mailto:b5327157@protonmail.com))

If it is not possible to use encrypted communication, send an unencrypted e-mail instead.

Please do not discuss the vulnerability publicly (i.e. on the mailing list or the ticket tracker) until it has been addressed.

## Vulnerability handling

Upon receiving the vulnerability report, the maintainers will:

1. Confirm the issue and determine its severity.
2. Patch the issue and release the patched version.
3. Publish a security advisory after the release.
