Security fixes target the affected repository's latest supported release or, for an unreleased project, its default branch. Repository-specific security policies define any additional supported versions and take precedence over this fallback.

Do not disclose a suspected or confirmed vulnerability through a public issue, pull request, discussion, or other public channel.

If private vulnerability reporting is available, use the affected repository's Security tab to report the vulnerability privately. If that option is unavailable, email security@psmodule.io.

Use the same private routes to report accidentally exposed sensitive information. Use these routes to report exposed credentials and exposed secrets. Use these routes to report weak or unsafe security controls or configurations.

Include the affected repository and version or commit. Include the vulnerability and its impact. Include the steps to reproduce it. If available, include any proof of concept or suggested mitigation.

PSModule handles reports privately, investigates them, and coordinates remediation and disclosure with the reporter.