The ChessRealms maintainers appreciate responsible reports of security vulnerabilities. Please help us protect users by reporting suspected vulnerabilities privately and allowing time for investigation before public disclosure.

Unless a repository documents a different support policy, security fixes are made for the latest released version and the default branch. Older releases may no longer receive security updates.

Use GitHub's private vulnerability reporting for the affected repository:

1. Open the repository's Security tab.
2. Select Advisories.
3. Select Report a vulnerability.

If private vulnerability reporting is not available, do not include sensitive details in a public issue. Open a minimal issue asking the maintainers for a private reporting channel, without describing the vulnerability, exploit, or affected users.

Do not report ordinary bugs, feature requests, or general support questions as security vulnerabilities. Use the repository's regular issue tracker for those reports.

Provide enough information for the maintainers to understand and reproduce the problem when possible:

• the affected repository, version, commit, or deployment;
• the type of vulnerability and its potential impact;
• the conditions required to reproduce it;
• clear reproduction steps or a minimal proof of concept;
• any known mitigations or workarounds;
• whether the vulnerability has been disclosed elsewhere.

Avoid including real credentials, personal data, or data obtained from systems you do not own or have permission to test.

The maintainers will acknowledge the report as soon as practical, investigate its impact, and keep communication in the private advisory. If the report is accepted, we will work with the reporter on remediation and coordinated public disclosure. Timelines depend on severity, complexity, and maintainer availability, so we do not promise a fixed resolution time.

We may close reports that are not reproducible, do not have a meaningful security impact, or concern unsupported versions. When possible, we will explain the reason.

When investigating a potential vulnerability:

• test only systems and data you own or are authorized to access;
• minimize access to data and stop if you encounter personal or confidential information;
• do not disrupt services, degrade availability, or destroy data;
• do not use social engineering, phishing, or physical attacks;
• give the maintainers a reasonable opportunity to address the issue before publishing details.

Good-faith reports that follow this policy are welcome. This policy does not authorize testing that would otherwise be unlawful or access to third-party systems.