Security fixes target the affected repository's latest supported release or, for an unreleased project, its default branch. Repository-specific security policies define any additional supported versions and take precedence over this fallback.

Do not disclose a suspected or confirmed vulnerability through a public issue, pull request, discussion, or other public channel.

Use the affected repository's Security tab to report the vulnerability privately when private vulnerability reporting is available. If that option is unavailable, email security@psmodule.io.

Use the same private routes to report accidentally exposed sensitive information, exposed credentials, exposed secrets, and weak or unsafe security controls or configurations.

Include the affected repository and version or commit, the vulnerability and its impact, steps to reproduce it, and any proof of concept or suggested mitigation. PSModule handles reports privately, investigates them, and coordinates remediation and disclosure with the reporter.