This policy applies to every repository in the wasmCloud GitHub organization that doesn't have its own SECURITY.md. The full process, including how reports are triaged, fixed and disclosed, is the wasmCloud Security Process and Policy.

CRA stewardship: This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project's emergency security reporting mechanisms as appropriate.

Don't report security vulnerabilities as public issues, discussions or pull requests. Report them privately in either of these ways:

• Email the private security list at security@wasmcloud.com with the details. This works for any repository in the organization.
• Use GitHub private vulnerability reporting from the Security tab of the affected repository, where it's enabled.

Reports go to the wasmCloud security team, a subset of the org maintainers. Each report is acknowledged within 3 business days. Advisories are published as GitHub Security Advisories in the affected repository.