Security policy

What is in scope

• tools/: the checkers, linters, generators and harness that run on this repository.
• The Grace connector and its Fly deployment.
• The site’s build.

The patterns themselves are specifications written in plain words. An ambiguity or a gap in one is not a security report: file it as a finding.

How to report

Report privately through the repository’s Security tab: “Report a vulnerability”. Never open a public issue for one.

What you can expect

An answer from the maintainer, then either a fix or a reason why not, and credit if you want it. This page promises no response time, because the project has not yet kept one.