# Security Policy

## Security contact information

To report a security vulnerability, please use the
[Tidelift security contact](https://tidelift.com/security).
Tidelift will coordinate the fix and disclosure.

## Escalation

If you do not receive an acknowledgement of your report
within 6 business days, or if you cannot find a private
security contact for the project, you may escalate to the
OpenJS Foundation CNA at `security@lists.openjsf.org`.

If the project acknowledges your report but does not
provide any further response or engagement within 14 days,
escalation is also appropriate.
