The maintainer applies security fixes to the most recent release of Yama. Earlier releases do not get security fixes.

Report a vulnerability with GitHub private vulnerability reporting:

https://github.com/livetribe/yama/security/advisories/new

Do not report a vulnerability in a public issue or a pull request. A public report tells an attacker about the problem before a fix is available.

Include these items in the report:

• The version of Yama that has the problem.
• The steps that show the problem.
• The effect of the problem, if you know it.

The maintainer sends the first reply in 7 days. The maintainer then sends a status update every 14 days until the report closes.

The maintainer publishes a GitHub security advisory when the fix is available. The advisory gives credit to the reporter, unless the reporter asks for no credit.