This policy covers every Budavári Schönherz Stúdió repository that has no SECURITY.md of its own.

Only the latest release, deployed from the default branch, gets security fixes.

Do not open a public issue, discussion or pull request for a security vulnerability.

Report it privately through GitHub's private vulnerability reporting:

1. Open the affected repository's Security tab.
2. Choose Report a vulnerability. The direct link is https://github.com/BSStudio/<repository>/security/advisories/new.

Please include the affected version or commit, the steps to reproduce it, and its impact.

We acknowledge reports within 7 days and keep you updated while we work on a fix. Once a fix is released we publish a GitHub security advisory and credit you, unless you ask us not to. Please give us a reasonable amount of time to fix the issue before you disclose it publicly.