We take security bugs seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

Please do not report suspected vulnerabilities in public issues, discussions, pull requests, or other public channels.

1. Creating a Security Advisory is the best way to report a vulnerability. Report a vulnerability
2. If private vulnerability reporting is unavailable, email security@natron.io.

When a security issue is confirmed, we will:

1. Develop and test a fix
2. Assign a CVE identifier if appropriate
3. Release a patched version
4. Publish a security advisory via GitHub Security Advisories