Please do not report security vulnerabilities through public issues, pull requests or discussions.

Instead, report them privately:

• Use GitHub's private vulnerability reporting, through the Security tab of the affected repository, if it is enabled.
• Otherwise, email ccpbiosim@stfc.ac.uk with the name of the affected project, a description of the issue, and steps to reproduce it.

We will acknowledge reports, investigate them, and keep you informed of progress. Please allow us reasonable time to fix an issue before disclosing it publicly.

Security fixes are made to the latest released version of each project.