This policy covers every public QuipNetwork repository that has no security policy of its own.

Report a vulnerability privately through GitHub:

1. Open the repository that has the problem.
2. Select Security, then Report a vulnerability.
3. Describe the problem, the affected version or commit, and the steps to reproduce it.

Do not open a public issue, discussion, or pull request for a vulnerability.

The maintainers read the report and reply in the private advisory. When a fix is ready, they publish a security advisory in the affected repository and credit the reporter, unless the reporter asks for no credit.

The maintainers fix vulnerabilities in the latest release of each project. A project can state other supported versions in its own SECURITY.md.