Do not open public issues for security vulnerabilities.
Report them privately via GitHub Security Advisories.
- Acknowledgment: within 48 hours
- Initial assessment: within 7 days
- Fix or mitigation: depends on severity, typically within 30 days
This policy covers all repositories in the celestia-island organization.