Only the current deployed revision of master is supported.

Do not open a public issue for a vulnerability that requires coordinated disclosure. Please follow the process below instead.

1. Private reports: email the current maintainers (listed on https://en.wikipedia.org/wiki/User_talk:Citation_bot) and include the words "security" and "vulnerability" in the subject line.
2. Non-sensitive bugs: report them on https://en.wikipedia.org/wiki/User_talk:Citation_bot.

When reporting, please include:

• The affected component and version (commit hash if known).
• A description of the vulnerability and its potential impact.
• Reproduction steps or a minimal proof of concept.
• Any suggested remediation, if you have one.

• Acknowledgment: we will aim to acknowledge receipt within 7 business days.
• Triage: the report is assessed for validity and severity within 4 weeks.
• Fix and disclosure: for valid reports, we aim to ship a fix and publish a coordinated disclosure (GitHub Security Advisory and/or release note) as soon as a fix is available, typically within 90 days for high-severity issues.
• Declined reports: if a report is not accepted, we will try to explain why.