Report low and medium severity security issues in a Weblate project as public GitHub issues in the affected repository.

For high and critical severity vulnerabilities, do not open a public issue. Report them privately by emailing security@weblate.org or selecting Security → Report a vulnerability in this repository.

If you are unsure of the severity, you may start privately. If the security team assesses the issue as low or medium severity, we will ask you to continue in a public GitHub issue.

Please describe the issue, affected versions, and steps to reproduce it, if known.

Public discussion allows the community to help review and fix low and medium severity issues, while private coordination focuses on vulnerabilities with serious impact. We publish security advisories only for high and critical severity vulnerabilities, not for low or medium severity issues.

For security scope and assumptions, consult this repository's threat model if it has one, or the Weblate threat model for the main application. The security documentation explains the full reporting and disclosure process.