By default, cofy-x repositories support security fixes for their latest stable release line and default branch.

Repository maintainers may publish stricter support matrices in local SECURITY.md files.

Do not report vulnerabilities through public issues.

Use GitHub Security Advisories for private disclosure:

• Report a vulnerability

Please include:

• Affected repository and version/commit
• Reproduction steps or proof-of-concept
• Impact assessment
• Any known mitigation

• We will acknowledge receipt as soon as practical.
• We will validate and triage the report.
• We will coordinate remediation and disclosure timing with the reporter.