Report a vulnerability in chard privately through GitHub's private vulnerability reporting: the repository's Security tab, then Report a vulnerability.

THREAT_MODEL.md decides what counts as a chard vulnerability. A hardening gap chard shows you in someone else's software is not one; take it to the project concerned.

To assist triage, please include:

• A clear description of the issue and its potential impact.
• Steps to reproduce or a proof of concept, if available.
• The affected commit hash.
• How you would like to be credited, if attribution is desired (e.g. name, known handle).

As a reporter, you can expect:

• A prompt acknowledgment of your report (within 72 hours).
• A transparent dialog and timely fix for valid issues.
• Disclosure at the fix or at 90 days, whichever comes first.
• Credit for disclosure, if desired.