This repository follows the HAX incident response process (source of truth for haxtheweb/*):
https://github.com/haxtheweb/issues/blob/master/INCIDENT_RESPONSE.md
The process defines incident severity (SEV1–SEV3), the response flow, communication, and post-incident review.
To report a security vulnerability, use the private reporting path in SECURITY.md — do not open public issues for unpatched security vulnerabilities.