We take security seriously. If you discover a vulnerability in any SuperInstance project, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please either:

1. Use GitHub's private vulnerability reporting:

   • Navigate to the affected repo
   • Click Security → Report a vulnerability
   • Fill out the advisory form

2. Email: Send details to [email protected] (if available) or open a private advisory.

Please provide as much of the following as possible:

• Description of the vulnerability
• Steps to reproduce (proof of concept)
• Affected versions
• Potential impact
• Suggested fix (if any)

• We follow coordinated disclosure.
• We will credit reporters in advisory publications (unless you prefer to remain anonymous).
• We will not take legal action against reporters acting in good faith.

Each project maintains its own support policy. Generally:

• The latest minor release receives security fixes
• Critical fixes may be backported to the previous minor
• End-of-life versions will not receive patches

Check individual repo READMEs for specific version support.

• Never commit secrets, API keys, or credentials
• Use environment variables or secret managers
• Review dependencies for known vulnerabilities (pip-audit, cargo audit, npm audit)
• Follow the principle of least privilege in all code

_{This policy is a living document. Improvements welcome via PR.}