This policy covers every public repository of the Plexito-de
organization that does not carry its own SECURITY.md.
Do not open a public issue for a vulnerability.
- Use GitHub's private reporting: open the repository's Security tab and select Report a vulnerability.
- If that is not possible, send an email to info@plexito.de with "Security" in the subject.
Include the affected repository and version, the steps to reproduce, and the impact you expect.
- We confirm receipt within 5 working days.
- We send an assessment and a planned fix date within 14 days.
- We credit you in the release notes, unless you ask us not to.
We fix security issues in the latest release of each project. Older releases do not get fixes.