# Reporting a vulnerability

> How to report a security issue privately and what happens next.

Source: https://pithyx.org/docs/project/security/
Markdown: https://pithyx.org/docs/project/security.md

Report a security problem privately through GitHub security advisories, not in a public issue. Include the affected version or commit, the steps to reproduce and the impact you expect.

## How to report

1. Open [github.com/pithyx/pithyx/security/advisories/new](https://github.com/pithyx/pithyx/security/advisories/new).
2. Describe the version or commit, how to reproduce the problem and what an attacker could do.
3. Do not open a public issue or post details elsewhere before a fix exists.

## What happens next

The project answers as soon as possible and coordinates a fix and its disclosure with you. There are no fixed response times. Only the latest release is supported; fixes land in the next release.