Security and vulnerability disclosure

Found a security problem in PikeBuild? How to report it, what we promise in return, and what is in scope. No bounty, and we say so up front.