This policy applies org-wide: it is the default for every TwoWells repository that does not define its own security policy.
Use GitHub's private vulnerability reporting: on the affected repository, Security → Report a vulnerability. Please do not disclose details in public issues, discussions, or PRs before a fix ships.
TwoWells releases follow the org-wide release contract documented in
PROVENANCE.md: immutable release assets, a published
.sha256 sidecar per asset, build-provenance attestations, and Trusted
Publishing for registries.
A checksum mismatch is a security signal, not a nuisance. If an install
fails hash verification (pacman, Homebrew, Scoop, or a manual
sha256sum -c), do not bypass the check and do not re-hash the download to
make it pass. See PROVENANCE.md's verification guidance, and report what you
found via the channel above.