Please report security issues privately through GitHub's private vulnerability reporting: https://github.com/PQBlocks/hybrid-jwe/security/advisories/new

Do not open a public issue for a suspected vulnerability. We aim to acknowledge reports within 3 working days, agree a fix and disclosure timeline with the reporter (normally no longer than 90 days), and credit the reporter in the advisory unless they ask otherwise.

This policy covers the code in this repository. The security posture of the package itself (what it protects, what it does not, constant-time and side-channel notes) is described in SECURITY_NOTES.md.