Thanks for helping keep The Skull Network and its projects secure. We take security seriously across all repositories in this organization, and we appreciate responsible disclosure from the community.

Unless a specific repository's README states otherwise, only the latest release (or the main/master branch) of a project is actively maintained and receives security fixes.

Please do not open a public GitHub issue for security vulnerabilities. Publicly disclosing a vulnerability before it's fixed can put users at risk.

Instead, report it privately through one of these channels:

• Email:theskullnetwork@proton.me (subject line: [SECURITY] <repo-name> - short description)
• GitHub Private Vulnerability Reporting: if enabled on the repo, use the "Report a vulnerability" option under the Security tab
• Discord: for non-sensitive/low-severity reports only, reach out to a staff member directly (do not post details in public channels)

When reporting, please include as much of the following as possible:

• Repository and affected version/commit
• A clear description of the vulnerability and its potential impact
• Steps to reproduce (proof-of-concept code, if applicable)
• Any suggested remediation, if you have one

• Acknowledgment: within 72 hours of your report
• Initial assessment: within 7 days, including severity triage
• Resolution timeline: communicated once the issue is confirmed; critical issues are prioritized
• Credit: with your permission, we'll credit you in the release notes / changelog once a fix ships

We ask that you give us reasonable time to investigate and patch before any public disclosure. If you don't hear back within 7 days, feel free to follow up.

This policy applies to all repositories under the TheSkullNetwork GitHub organization. Some projects (e.g. OSINT/recon tools) are intended for authorized, ethical, and legal use only — misuse of these tools is outside our control and outside the scope of this policy.

Out of scope by default:

• Vulnerabilities in third-party dependencies (please report upstream, but let us know too if it affects us)
• Issues requiring physical access to a user's device
• Social engineering attacks against maintainers or contributors

We support responsible security research. If you make a good-faith effort to comply with this policy while researching a vulnerability — avoiding privacy violations, data destruction, and service disruption — we will not pursue legal action against you for that research.

Researchers who responsibly disclose valid vulnerabilities may be listed in a project's SECURITY.md acknowledgments or release notes, if they'd like to be credited.

Operating securely. Coding efficiently. — The Skull Network 💀