This policy applies to every repository in the Kyanite organization.

The stack is experimental and pre-1.0. Only the latest commit on the default branch of each repository is supported. There are no backports or long-term support branches yet.

Please do not open public issues for security problems.

Report privately using either:

• GitHub's "Report a vulnerability" button under the affected repository's Security tab (preferred), or
• email security@kyanite.computer.

Please include:

• the affected repository and version/commit,
• a description of the issue and its impact,
• steps to reproduce or a proof of concept,
• any relevant logs, crash output, or hardware/target details.

• We aim to acknowledge reports within a few business days.
• We practice coordinated disclosure: we will work with you on a fix and a disclosure timeline before any public announcement.
• There is no bug-bounty program at this time. Credit will be given to reporters who wish to be named.