Please do not report security problems in public issues, pull requests, or chat.

Report them privately through GitHub's private vulnerability reporting. If you can't use GitHub, email hello@sourcify.dev.

Please include:

• a description of the problem and its impact,
• steps to reproduce it, and
• a suggested fix, if you have one. You can attach a patch to the private report.

We will reply as soon as we can and keep you informed while we work on a fix. Please give us time to fix the problem before you disclose it in public.

This policy covers the code in this repository and the hosted Sourcify service at sourcify.dev.

Sourcify has no bug bounty program.