Please do not report security vulnerabilities in public issues or pull requests.
Report them privately by email to [email protected], with a description, the affected version and configuration, and steps to reproduce. You will receive an acknowledgement within 3 days and an initial assessment within 14 days; we then coordinate a fix and disclosure timeline with you.
The full policy, including how vulnerabilities are handled, is in the openartifact SECURITY.md.