This policy covers every public repository in the osrs-tracker organization that doesn't have its own SECURITY.md.
Only what is deployed from each repository's main branch is supported. Older tags and releases get no fixes.
For the @osrs-tracker npm packages (osrs-tracker-packages), only the latest
published version of each package gets fixes.
Please don't open a public issue. Report it privately instead:
- GitHub: the "Report a vulnerability" button on the repository's Security tab (private vulnerability reporting).
- Email: the contact in security.txt.
Include the affected repository or URL, steps to reproduce, and the impact you expect.
- An acknowledgement of your report.
- A fix, or an explanation of why no change is needed, as soon as is practical for a project maintained by one person.
- Credit in the advisory if you want it.
There is no bug bounty.