YorvoID is security software, so we treat reports about it with priority.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Every YorvoID package is developed in yorvoid/yorvoid; the package repositories, such as yorvoid/core, are read-only copies of it. Report vulnerabilities in any of them privately, in the monorepo:

1. Go to Report a vulnerability in yorvoid/yorvoid.
2. Describe the issue: the affected package and version or commit, the type of issue, steps to reproduce, and the impact.

Only the maintainers can see your report. What happens next, the supported versions and the scope are in the full security policy.