Report a vulnerability through GitHub private vulnerability reporting. For supported versions and the response process, see the JST compatibility contract and support policy.

Security fixes target the latest stable release of each published JST package and the current template release. Older generated applications remain owned by their maintainers and should migrate before requesting a backport.

Use GitHub private vulnerability reporting in the affected repository. Do not disclose the issue in a public issue, pull request, discussion, or chat.

Include affected versions, impact, reproduction steps, and known mitigations. The maintainer aims to acknowledge a complete report within seven days, then coordinates validation, remediation, release, and disclosure according to severity. This is a response target, not a contractual SLA.

Do not access data you do not own, disrupt services, or publish details before coordinated disclosure. Good-faith research that follows this policy is welcome.