Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, please report vulnerabilities privately using GitHub Security Advisories for this repository. This allows maintainers to assess and address the issue before it is publicly disclosed.

If private vulnerability reporting is not enabled for this repository, report the vulnerability privately to lamassu+security@lksnext.com before disclosing any details publicly.

When reporting, please avoid including:

• Credentials, tokens, or private keys
• Customer data or customer-identifiable information
• Confidential architecture or internal infrastructure details

Instead, describe the vulnerability, its potential impact, and steps to reproduce it using non-sensitive, redacted examples.

The main branch and the latest published release are supported with security updates. Older releases and branches are not supported unless explicitly documented. As the project is still under initial development, no stable releases are currently available; security fixes will be applied to the active development version. Users should upgrade to the latest supported release or commit as soon as fixes are published.

We ask that you:

• Give us reasonable time to investigate and address a reported vulnerability before any public disclosure.
• Make a good faith effort to avoid privacy violations, data destruction, and service disruption while researching a vulnerability.
• Only interact with accounts or data you own, or with explicit permission.

We will acknowledge reports in a timely manner and keep you informed of remediation progress.

This policy covers the source code, configuration, and CI/CD workflows maintained in this repository.