Do not open a public issue for security vulnerabilities.

Report them privately to info@forkbomb.eu. Please include:

• the affected product or version,
• a description of the vulnerability,
• steps to reproduce, and
• any workarounds you have found.

We will acknowledge your report within 5 working days and aim to publish a fix and advisory as quickly as possible. We credit reporters who follow responsible disclosure, unless you ask us not to.

We support the latest release and the current default branch of each project.

Security fixes are released through normal release channels with an advisory, coordinated with the reporter.