At this time, only the latest minor release (v0.x) will typically receive security patches. Exceptions may be made depending on severity.

The preferred method of reporting security issues is to open a JIRA ticket. When creating an issue, please set the issue type to "Security" and enter your email address in the appropriate field. Please do not select any issue type other than "Security" for reporting security issues. If you do, the issue will be visible and may put others at risk of exploitation. You should receive one automated reply shortly afterwards, then a follow-up from a maintainer within 24 hours.

If you are not contacted by a maintainer within 24-hours, please reply to the automated email you were sent, or send an email directly to security@cythral.com and reference the ticket number you were given (LAMBJ-XXXX). Maintainers will contact you via email from one of the following addresses:

• noreply@automationforjira.com (a reply-to address will be given)
• security@cythral.com

If for some reason reporting an issue on JIRA does not work, please email security@cythral.com directly with your concern.