Do not report a suspected vulnerability in a public issue, discussion or pull request.
Use GitHub private vulnerability reporting. On this repository's Security tab, choose Report a vulnerability. The report arrives attached to the repository, with a draft advisory and a CVE request path in place. It is off by default, so switch it on once the repository is public, and keep naming it here only while the button is there:
gh api -X PUT repos/ichava/icon-sets-extras/private-vulnerability-reportingOr email security@simtabi.com. That is the only
disclosure address, and it works whether or not the button is available. Other
Simtabi addresses, including ichava@simtabi.com, handle community mail and
may delay a report.
Response times, coordinated disclosure, safe harbor and credit follow the organisation security policy.
This package ships icon assets and the provider that registers them with
ichava/core.
Core owns sanitisation, caching, seeding and the HTTP surface, so a defect in how an icon is sanitised, cached or served belongs to ichava/core rather than here. What belongs here is the vendored assets themselves, this package's own registration code, and anything in its build or sync tooling that widens what a refresh can reach.