Aeterna is actively maintained on the main branch.

Please do not open public GitHub issues for security problems.

Use one of these private channels:

1. GitHub Private Vulnerability Reporting (preferred)
   • Go to the repository Security tab.
   • Click Report a vulnerability.
   • Submit details privately to maintainers.

To help us triage quickly, include:

• A clear description of the issue and impact
• Affected component(s) and version/commit
• Reproduction steps or proof-of-concept
• Any logs, stack traces, or screenshots
• Suggested fix or mitigation (if known)

We aim to:

• Acknowledge valid reports within 72 hours
• Share initial triage within 7 days
• Provide a fix timeline based on severity and complexity

Please allow us time to investigate and patch before public disclosure. We will coordinate disclosure timing with the reporter whenever possible.

This policy covers vulnerabilities in:

• backend/ (Go API and services)
• frontend/ (React web app)
• Deployment files and scripts (docker-compose*, install.sh, etc.)

Out of scope:

• General support questions or feature requests
• Vulnerabilities only in third-party services you run externally