This library has only a single dependency on Jakarta JSR 330 library with annotations, which means that any security issue found should be reported immediately.

We scope reports to issues in the published io.github.suppierk:inject artifact. Vulnerabilities in downstream applications that simply consume the library fall outside of this policy.

If you discover a vulnerability:

1. Email suppie.rk@gmail.com with the details. This inbox is monitored weekly.
2. Expect an acknowledgement within 7 calendar days. If you do not receive a response, please follow up on the email thread.
3. Once triaged, we will share a remediation plan and target disclosure date.

If email is unavailable, you may open a private security advisory on GitHub instead of a public issue.

Pull requests are always welcomed.