# Security

Report vulnerabilities privately through GitHub Security Advisories:

https://github.com/wiremuxhq/wiremux/security/advisories/new

Do not open a public issue for a security report.

We aim to acknowledge a report within 7 days. Include enough detail
to reproduce the issue (version or commit, steps, and impact). Credit
in `CHANGELOG.md` when a fix ships.

This workspace publishes `wiremux-auth` and `wiremux`. Reports that
only affect a host application belong in that host's advisory
process.

| Check | Where |
| --- | --- |
| Private reports | GitHub Security Advisories, not public issues |
| Secret scanning | GitHub secret scanning and push protection |
| Supply chain | cargo-deny, Dependabot, CodeQL, gitleaks, FOSSA |