This policy applies across the EpiAware organisation's packages.

Please do not report security vulnerabilities through public issues, pull requests, or discussions.

Instead, use GitHub's private vulnerability reporting on the affected repository:

1. Go to the repository's Security tab.
2. Select Report a vulnerability.
3. Describe the issue, the affected versions, and steps to reproduce.

We aim to acknowledge reports within a few working days and will keep you informed of progress towards a fix. Once a fix is released we will credit reporters who wish to be named.

Fixes are released against the latest registered version of each package. We recommend tracking the most recent release.