We take the security of exo seriously. If you believe you have found a security vulnerability, please report it privately so we can address it before it is publicly disclosed.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, use GitHub's private vulnerability reporting for this repository:

1. Go to the Security tab of the repository.
2. Click Report a vulnerability to open a private advisory.

Please include as much of the following as you can, to help us understand and reproduce the issue:

• The type of issue and its potential impact.
• Affected version(s) of exo and your environment (OS, git-annex version).
• Step-by-step instructions to reproduce the problem.
• Proof-of-concept or exploit code, if available.
• Any relevant logs or output (with secrets redacted).

• We will acknowledge your report as quickly as we can.
• We will investigate, keep you informed of our progress, and let you know when a fix is available.
• We ask that you give us a reasonable amount of time to release a fix before any public disclosure, and that you avoid accessing or modifying other users' data while researching the issue.

Security fixes are applied to the latest released version. We recommend always running the most recent release of exo.

Thank you for helping keep exo and its users safe.