Status: interim placeholder. This repository does not yet have a finalised security policy. A Diamond Light Source-wide policy is expected to supersede this document in due course; until then, the guidance below applies.

Please report suspected security vulnerabilities privately, so an issue can be assessed and addressed before any public disclosure.

• Preferred: open the repository's Security tab and select Report a vulnerability to submit through GitHub's private vulnerability reporting.
• Alternatively, email the Diamond Light Source security team at <contact to be confirmed>.

Please do not open a public issue, pull request, or discussion for security matters.

We will acknowledge valid reports and keep you informed as we investigate. As this is an interim policy, timelines are best-effort and not yet formalised.

This policy applies to the source code in this repository. Known-vulnerable dependencies are tracked separately through automated dependency updates and vulnerability alerts.