Only the latest tagged release receives security updates.

If you discover a security vulnerability in AKSUM, please report it privately by emailing the QYVORA OffSec team at qyvorasec@gmail.com. Do not open a public GitHub issue.

We will acknowledge receipt within 48 hours and provide an estimated timeline for a fix. Once the fix is released, we will credit the reporter (if desired) in the release notes.

• Website: https://qyvora.org
• Security contact: qyvorasec@gmail.com
• Organisation: QYVORA OffSec — Tamale, Ghana

This policy covers the AKSUM source code, build pipeline, and release artifacts. Issues related to the targets being scanned (e.g., a vulnerability discovered by AKSUM on a target) are out of scope — those should be reported to the target owner.

We ask that you give us reasonable time to patch and release a fix before any public disclosure.