Do not post vulnerability details in public issues.

Use GitHub's private vulnerability reporting for this repository when the Report a vulnerability action is available. If it is unavailable, open a public issue asking the maintainers for a private reporting channel. Include no vulnerability details, reproduction steps, logs, credentials, or affected-system information in that issue.

Include, where possible:

• the affected commit, tag, or pre-release;
• the security impact and who or what may be affected;
• a minimal reproduction using synthetic data;
• any known mitigations or workarounds.

Do not send production credentials, personal data, private client material, or other live secrets. Replace them with synthetic examples.

The maintainers will acknowledge the report and coordinate validation, remediation, and disclosure as project capacity allows. We do not promise a fixed response or remediation SLA while LychD is pre-release.

LychD is pre-release software. Security work targets the current main snapshot and the latest published pre-release when one exists. Older commits, development branches, and unmaintained local modifications are not supported versions.

Please allow the maintainers time to validate and mitigate the issue before public disclosure. When appropriate, remediation and disclosure will be coordinated through a GitHub Security Advisory.