# Security policy

Report vulnerabilities **privately**, never in a public issue.

1. Open https://github.com/remorses/sigillo/security/advisories/new
2. Describe the issue, affected component (`app`, `provider`, `cli`) and steps to reproduce

Both sigillo.dev and self-hosted instances are in scope. Fixes ship to sigillo.dev first, then to self-hosters through a new release.