Report a security issue in private. Use GitHub private vulnerability reporting for this repo. Report here: https://github.com/infralicious/actions-checkout/security/advisories/new Do not open a public issue for a live flaw. Do not send a token in a report. This repo holds no secret of its own. It pins upstream by SHA. It defaults to no persisted credential.

We follow coordinated disclosure. We will not publish a flaw before a fix ships. We will credit the reporter if they want credit.

We will acknowledge a vulnerability report promptly. We will share a fix timeline after triage. We will ship a fix for supported versions only. Supported versions are the current tag only.