Security policy

This policy covers every public repository in the osrs-tracker organization that doesn't have its own SECURITY.md.

Supported versions

Only what is deployed from each repository's main branch is supported. Older tags and releases get no fixes.

For the @osrs-tracker npm packages (osrs-tracker-packages), only the latest published version of each package gets fixes.

Please don't open a public issue. Report it privately instead:

GitHub: the "Report a vulnerability" button on the repository's Security tab (private vulnerability reporting).
Email: the contact in security.txt.

Include the affected repository or URL, steps to reproduce, and the impact you expect.

An acknowledgement of your report.
A fix, or an explanation of why no change is needed, as soon as is practical for a project maintained by one person.
Credit in the advisory if you want it.

There is no bug bounty.