This policy applies to the Cartesi repositories that do not have a SECURITY.md of their own.

Cartesi Rollups is under active development. Please check that the issue is present in the most recent release of the affected repository before reporting it.

Please do not open a public issue, pull request or discussion for a security problem.

Report it privately by email to rollups@cartesi.foundation. Include the affected component and version, the impact, and steps to reproduce.

We review each report, decide how to handle it, and reply with the outcome. When a fix is released and the issue affects users, we may describe it on the Audit Reports page of the Cartesi documentation.

Please give us a reasonable time to fix an issue before you disclose it publicly.