# Workflow: report a CVE

Goal: report and fix a security vulnerability without premature disclosure.

**Do not open it on `hackers@` or any public channel.**

1. **Email `security@solnix.io`** (the private, embargoed list). Sign the email.
   Include: affected package(s) + edition(s)/rev, the vulnerability, a reproducer
   if you have one, and any proposed fix.
2. **The security contact** is also in `https://solnix.io/.well-known/security.txt`
   (RFC 9116). You may use that address.
3. **The CVE lane is private by design:** the fix is built on `security@`, a
   simultaneous fix is coordinated across all supported editions, and only then
   is it disclosed. This prevents a window where the vuln is public but unpatched.
4. **Backports:** supported editions (e.g. `26.11`) receive the fix; `unstable`
   gets it too. See `steering/edition-policy.md`.
5. **Disclosure** happens on `announce@` and the news feed once fixes are
   published and users can upgrade.

If you're unsure whether something is security-sensitive, treat it as sensitive
and use `security@` — it's cheap to be cautious here.