Please do not report vulnerabilities in public issues, discussions, or pull requests. Use GitHub's private vulnerability reporting page to send the maintainers a confidential report. If private reporting is unavailable, email the maintainer listed in CBox.toml and include "CBox security report" in the subject.

Include, when possible:

• The affected CBox version, commit, or release.
• The operating system, compiler, and relevant configuration.
• A concise description of the impact and conditions required to reproduce it.
• A minimal proof of concept or reproduction steps. Do not include real credentials, private data, or destructive payloads.

The maintainers aim to acknowledge reports within five business days and will share progress as they investigate. Please allow time to assess and address a report before disclosing it publicly. There is currently no bug bounty program.

Security fixes are prioritized for the latest released version. Whether older versions are affected or can be fixed will be assessed case by case.