Please do not report a security problem in a public issue or pull request.

Report it privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Include what you found, the commit or release it affects, and the steps to reproduce it.

If you cannot use GitHub, email udan-security@nistapp.com.

We aim to acknowledge a report within 5 working days, and to keep you informed until it is fixed or closed. Please give us a reasonable time to fix a problem before you disclose it publicly.

This policy covers the code in this repository: the Quarkus server, its build and CI scripts, and its container image definition. Problems in third-party dependencies are welcome as reports too; the dependency scan in CI reports known advisories.