# Reporting Vulnerabilities

**⚠️ Please do not file public GitHub issues for security vulnerabilities as they are open for everyone to see! ⚠️**

We encourage responsible disclosure practices for security vulnerabilities.

## Reporting a Vulnerability

If you believe you've found a security-related bug, fill out a new
vulnerability report via GitHub directly. To do so, follow these instructions:

1. Click on the `Security` tab in the project repository.
1. Click the green `Report a vulnerability` button at the top right corner.
1. Fill in the form as accurately as you can, including as many details as possible.
1. Click the green `Submit report` button at the bottom.

## Don't have a GitHub account?

Alternatively, to report a security vulnerability, please use the
[Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.

It is currently set up to forward every incoming report to Bernát Gábor. We will try to assess the problem in timely
manner and disclose it in a responsible way.
