Security fixes land on main and ship with the next release. Once main works towards a new major release (before 1.0: a new 0.y), we do not make patch releases for the already released major version, as that would mean maintaining multiple branches.

Need fixes backported to a released version? That is available under a partner contract, see ramaproxy.com.

If you discover a vulnerability, please do the following:

• E-mail your findings to security [at] plabayo [dot] tech.
• Or alternatively report it securely at https://github.com/plabayo/rama/security/advisories.
• Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data.
• Do not reveal the problem to others until it has been resolved.
• Do not use attacks on physical security, social engineering, distributed denial of service, spam or applications of third parties.
• Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Complex vulnerabilities may require further explanation!