Do not open a public issue. Use the "Report a vulnerability" button under the Security tab of the affected repository — reports stay private between you and the maintainer.
If private reporting is unavailable on that repo, reach out through the contact links on vertciti.com instead.
- First response within 48 hours.
- Progress updates as the fix lands.
- Credit in the fix notes, if you want it.
No substantive response within 6 business days → the report goes directly to the founder/CEO. Security reports are never ignored here.
This file cascades as the default for every repository under @HUIIIM that doesn't define its own policy. A repo with its own SECURITY.md overrides this one.