This policy applies to every repository in the Rathkit organization that does not have its own SECURITY.md.

Rathkit's projects (RTE, a rich text editor, and Pack, a bundler) are pre-release and nothing is published yet. Reports are still welcome: early reports are the cheapest to fix.

Please do not open a public issue, pull request or discussion for a suspected vulnerability.

1. If the repository shows a Report a vulnerability button under its Security tab, use it. That keeps the report private on GitHub.
2. Otherwise, email github@rathkit.com with the subject Security: <repository name>.

Include what you found, the steps to reproduce it, and the version or commit you tested. Please do not include real personal data or anyone else's content.

This is a small project. We read every report, we will acknowledge it and tell you what we decide, and we do not yet have a fixed response time. We will credit you in the fix if you want that.

Nothing is released yet. After a project's first release, security fixes ship in its current release, for every user. For RTE, safety fixes are never limited to a paid plan; see Free and paid.