This policy applies to every repository in the magnetite-browser organisation that does not carry its own SECURITY.md.

Report it privately, not in a public issue, through the repository's "Report a vulnerability" page (Security tab, Advisories), or by mail to security@magnetitebrowser.org.

Please include the affected repository and part, the commit you tested, steps to reproduce, and the impact. We will acknowledge the report, keep you updated, and credit you in the fix unless you prefer not to be named. Please give us a reasonable time to fix the issue before you disclose it.

In scope is Magnetite's own code: the browser, the magnetite-sync server and its protocol, the importers and the website.

Chromium and CEF bugs belong upstream (Chromium, CEF). Magnetite pins a CEF version, so upstream fixes reach Magnetite when we update CEF. Tell us if a release we pin is affected.