Please report vulnerabilities privately. Do not open a public issue.

On the repository the problem is in, open the Security tab and choose Report a vulnerability. That creates a private security advisory that only you and the maintainers can see. If you are not sure which repository is affected, use the one closest to it.

Please include:

• the repository, and the version or commit you tested;
• what the problem is and what an attacker could do with it;
• steps to reproduce, or a proof of concept;
• any fix or mitigation you already know of.

All repositories in the ComlineProject organization.

Only the latest main (or master) of each repository is supported. Fixes are made there; older commits and releases are not patched.

We will read your report and reply on a best-effort basis; this is a volunteer project and we cannot promise a response time. We would like to credit you in the advisory, and will unless you ask us not to. We do not offer a bug bounty.