This policy applies to every public Heidrun repository: heidrun, heidrun-protocol, heidrun-server, and heidrun-spirit.

Heidrun is pre-1.0. Security fixes are made against the latest release (and the current development branch). Older tagged releases are not patched — please update to the latest version.

Please report security issues privately. Do not open a public issue, pull request, or discussion for a suspected vulnerability.

You have two private channels:

1. GitHub private vulnerability reporting — on the affected repository, open the Security tab and choose Report a vulnerability. This opens a private advisory visible only to you and the maintainer.
2. Email — jens.francke@daubit-francke.de. PGP is not currently offered; if you need encrypted transport, say so in an initial low-detail message and we'll arrange a channel.

Please include:

• the affected repository and version (tag or commit),
• a description of the issue and its impact,
• steps to reproduce or a proof of concept, and
• any suggested remediation, if you have one.

• Acknowledgement within a few days of your report.
• An assessment and, where the issue is confirmed, a fix timeline.
• Credit in the release notes / advisory when the fix ships, unless you ask to remain anonymous.

Thank you for disclosing responsibly.