Report a vulnerability

Email security@latchyard.com, or use GitHub private vulnerability reporting on the Latchyard repository. Please don't open a public issue.

How we handle a report

Coordinated disclosure We fix the issue, then publish it. The disclosure policy in the repository's SECURITY.md states the channels, response targets and terms.
GitHub security advisories with CVEs Each advisory is a GitHub security advisory, with a CVE requested through GitHub. It publishes together with the release that fixes it. Exploit detail may wait, the advisory never does.
The signed notice feed Self-hosted instances pull a signed security-notice feed from latchyard.com, which carries each advisory. It works with telemetry off.

A declared support period of five years Security fixes ship in the latest release. Upgrading is free and needs no costly change to your environment.
Upgrades stay non-disruptive The minimum PostgreSQL, operating system or CPU architecture rises only when upstream support ends.
Releases stay available Each release stays available for 10 years.

The same contact details are in /.well-known/security.txt, in the RFC 9116 format.