Security Policy

Supported Versions

This repository publishes a course website. Only the current content on main is supported.

Reporting a Vulnerability

Do not open a public issue for a security problem. A public report tells everyone about the problem before a fix exists.

Email instead. Include a description of the issue, the steps you took to create it, the affected versions, and, if you know them, the mitigations. This project follows a 90 day disclosure timeline.

If you use a coding agent while you investigate, keep the initial report private. An agent can help you reproduce the bug, prepare a minimal fix, update the documentation, and run local validation. The maintainer handles the private disclosure and the final release decision.

Back to top