krak-lite is pre-1.0; security fixes are applied to the latest released version only. Please make sure you are on the most recent release before reporting.

Please do not open a public issue for security vulnerabilities.

Report them privately instead, using either:

• GitHub's private vulnerability reporting (Security tab → Report a vulnerability), or
• email kraklite@karibsen.fr.

Please include:

• a description of the issue and its impact,
• steps to reproduce (or a proof of concept),
• the affected version(s).

You can expect an initial acknowledgement within 72 hours. Once the issue is confirmed and fixed, we will publish a release and credit you in the advisory (unless you prefer to remain anonymous).