If you discover a security vulnerability, please do not open a public issue.

Instead, report it using one of the following private channels:

• GitHub’s Private Security Advisory feature
• Email: security@ctrf.io

If your report contains sensitive information, please note this in the subject line.

This security policy applies to:

• The CTRF specification
• Reference implementations
• Official repositories under the CTRF organization

Third-party dependencies should be reported to their respective maintainers.

We aim to:

• Acknowledge reports within 3 business days
• Provide a status update as the investigation progresses
• Coordinate a fix and responsible disclosure when appropriate

We appreciate responsible disclosure and will work with reporters in good faith.