# Security Contact And Response

## Security Contact And Response Times

Primary private reporting channel: GitHub Security Advisories for this repository.

- Create private report: [git-lrc private vulnerability report](https://github.com/HexmosTech/git-lrc/security/advisories/new)

Fallback private channel (if GitHub reporting is unavailable): [shrijith@hexmos.com](mailto:shrijith@hexmos.com).

We treat security issues as high-priority work. This address is the founder’s direct inbox so reports receive immediate attention.

Disclosure process:

1. We acknowledge receipt within 2 business days.
2. We begin triage and remediation planning within 7 calendar days for findings confirmed by our internal security review.
3. We coordinate disclosure timing with the reporter for high-impact issues.

Please include reproduction steps, lrc version, platform, and impact.