This is the default policy for every NCodeGroup repository that doesn't have a SECURITY.md of its own. A repository's own file, such as the one in NCodeGroup/Identity, takes precedence.

Please do not report security vulnerabilities through public GitHub issues.

Report privately through GitHub's private vulnerability reporting: open the affected repository's Security tab and choose Report a vulnerability. Include a description, the affected package and version, steps to reproduce, and the impact. You will get an acknowledgement, and we will coordinate a fix and a disclosure timeline with you.

Please give us a reasonable window to release a fix before any public disclosure.

Only the latest published version of a package is supported, unless the repository's own policy says otherwise.