Only the latest release of each repository or published module is supported for security fixes. Update to the latest release before assessing whether a fix is already available. Older releases are not supported by this policy.

Use the affected repository's Security → Report a vulnerability form to create a private GitHub security advisory report when private reporting is available. If the form is unavailable, or you cannot identify the affected repository, email licensing@wippy.ai.

Include the repository/module, release and runtime versions, affected component, impact, and minimal reproduction steps or proof of concept. Redact credentials, access tokens, and personal or customer data. Do not open a public issue or discussion containing an exploit or sensitive report.

Maintainers assess the report privately, may request details, and coordinate a fix and disclosure with the reporter. Keep vulnerability details private until that coordination is complete. A published GitHub security advisory can document affected versions, mitigations, and the fixed release.

For ordinary defects without a security impact, use the bug-report issue form.