This is the organization default. If the affected repository has its own security policy, follow that policy instead.

Do not publish exploit details, credentials, or sensitive logs in a public issue.

1. If the affected repository offers Security → Report a vulnerability, use GitHub's private vulnerability reporting form.
2. Otherwise contact helloworld@linkerbot.cn, the organization's published contact address, with the subject Security report: <repository>. Start with a brief description and request a suitable private channel before sharing highly sensitive material.

Include the repository and affected version/commit, impact, prerequisites, a minimal reproduction if safe to share, and any proposed mitigation. Remove credentials and personal data. Avoid testing against other people's devices or systems.

Support varies by project. Consult the affected repository's releases and security policy. This default policy does not promise support for every historical version or a fixed response time.

For issues involving unexpected physical movement, stop the hardware test and follow the device's documented safe-stop procedure. Share the relevant model, firmware, and circumstances privately if they expose a vulnerability.

安全漏洞请私下报告，不要在公开 Issue 中发布利用细节、凭据或敏感日志。优先使用目标仓库已启用的私密漏洞报告功能；没有该入口时，通过组织公开邮箱联系并请求合适的私密沟通渠道。各项目支持的版本以其自身说明为准。