Report suspected vulnerabilities privately to security@packdb.io. Do not open a public issue with exploit details, tokens or customer data. If available, the repository's GitHub private vulnerability reporting form is an additional channel. See MAINTAINERS.md for responder coverage and contact-delivery verification.

Include affected version, platform, impact and a minimal synthetic reproducer. Maintainers aim to acknowledge within three business days and provide a triage update within seven; these are community targets, not service guarantees. Coordinate publication timing based on severity and remediation. Credit reporters with their consent and publish an advisory for affected released versions.

Only the latest minor release line receives fixes by default during 0.x development; README lists any additional supported lines and their end dates. Prereleases are experimental. Unsupported versions should upgrade, with storage migration guidance where needed. Do not interpret this policy as authorization to test third-party services or access other users' data.