This is the default security policy for every public repository in the goceleris organization (celeris, probatorium, loadgen, docs). If a repository ships its own SECURITY.md, that file takes precedence for that repository.

Do not open a public issue or pull request for a security problem. Report it privately through either channel:

• GitHub private advisory — in the affected repository, open the Security tab and choose Report a vulnerability. This opens a private draft advisory visible only to you and the maintainers. For the engine: https://github.com/goceleris/celeris/security/advisories/new
• Email — security@goceleris.dev

Please include:

• A description of the issue and the repository/version affected
• Steps to reproduce (a minimal program, request trace, or capture helps)
• The impact you believe it has
• A suggested fix, if you have one

• Acknowledgement within 72 hours of your report.
• We will keep you informed while we triage, reproduce, and fix the issue, and we will agree on a disclosure date with you before anything is published.
• Fixes ship as patch releases of the affected module. The published advisory credits the reporter unless you ask us not to.

Security advisories for the engine are published in goceleris/celeris: https://github.com/goceleris/celeris/security/advisories. The harness and tooling repositories (probatorium, loadgen, docs) are covered by this policy; anything that turns out to be an engine issue is tracked and disclosed in celeris regardless of where it was first reported.