Security Policy

As a U.S. Government agency, the General Services Administration (GSA) takes
seriously our responsibility to protect the public's information, including
financial and personal information, from unwarranted disclosure.

Reporting a Vulnerability

Services operated by the U.S. General Services Administration (GSA)
are covered by the GSA Vulnerability Disclosure Program (VDP).

See the GSA Vulnerability Disclosure Policy at https://www.gsa.gov/vulnerability-disclosure-policy
for details including:

• How to submit a report if you believe you have discovered a vulnerability.
• Bug bounty scope.
• GSA's coordinated disclosure policy.
• Information on how you may conduct security research on GSA developed
  software and systems.
• Important legal and policy guidance.

Supported Versions

Please note that only certain branches are supported with security updates.

When using this code or reporting vulnerabilities please only use supported
versions.