Please report suspected vulnerabilities in the affected project repository, not in a public Issue, pull request or Discussion. Open Security → Advisories → Report a vulnerability to submit a private report. Reports in English or Chinese are welcome.

Include the affected version or commit, prerequisites, reproduction steps or a minimal proof of concept, and the potential impact. Remove credentials, personal information and unrelated private data. A CWE classification is not required by this policy.

If the private reporting entry is unavailable, ask a maintainer for a private contact channel without disclosing vulnerability details publicly. Do not use this .github repository for vulnerabilities in another project.

Coordinate disclosure with maintainers while the issue is investigated and a fix is prepared. Response and remediation times depend on impact and maintainer availability; this policy does not promise a fixed deadline or a bounty.

Supported versions and any project-specific reporting instructions belong to each project's security policy. This organization-wide policy does not promise fixes for all historical versions. Ordinary bugs and usage questions should follow the support guide.

发现疑似安全漏洞时，请在受影响项目的仓库中打开 Security → Advisories → Report a vulnerability，提交私密报告。请勿通过公开 Issue、PR 或 Discussions 披露漏洞；接受中文或英文报告。

请提供受影响的版本或 commit、触发前提、复现步骤或最小概念验证，以及潜在影响。移除凭据、个人信息和无关私密数据。本政策不要求填写 CWE 分类。

如果私密报告入口不可用，请向维护者询问私密联系渠道，不要公开漏洞细节。其他项目的漏洞不要提交到此 .github 仓库。

调查和准备修复期间，请与维护者协调公开披露时间。响应和修复时间取决于影响及维护者可用时间，本政策不承诺固定期限或漏洞赏金。

支持的版本范围及项目专属报告方式以各项目的安全政策为准；组织默认政策不承诺修复所有历史版本。普通 Bug 和使用问题请参阅支持指南。