This is the organization-wide default security policy for FAST projects. An individual repository may provide its own SECURITY.md that takes precedence.

If you discover a security vulnerability — or a safety issue in hardware, firmware, or software that could put users at risk — please report it privately.

Do not open a public issue for security or safety vulnerabilities.

Instead, email joshua.pearce@uwo.ca with:

• A description of the issue and the affected project/repository.
• Steps to reproduce or a proof of concept, if available.
• The potential impact as you see it.

Please allow reasonable time for the issue to be investigated and addressed before any public disclosure. We appreciate responsible disclosure and will credit reporters who wish to be acknowledged.

Many FAST projects are physical hardware. "Security" here includes both digital vulnerabilities (in firmware, control software, and data handling) and physical safety concerns (electrical, thermal, mechanical) that could arise from a design or documentation defect.