If you believe you have found a security vulnerability in this project, we encourage you to report it responsibly. Please do not open a public GitHub issue for security vulnerabilities.

Use GitHub's built-in private vulnerability reporting to submit your report:

1. Navigate to the Security tab of this repository.
2. Click "Report a vulnerability" under Private vulnerability reporting.
3. Fill out the advisory form with as much detail as possible.

Alternatively, you can go directly to:

https://github.com/dbt-labs/dbt-charts/security/advisories/new

This repository is mirrored from a private upstream, so fixes are made there before being published here. You will not see a fix land as a pull request against this repository.

To help us understand and resolve the issue quickly, please include:

• A description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce the issue.
• The affected version(s) of dbt-charts.
• Any relevant logs, screenshots, or proof-of-concept code.
• Your suggested severity (Critical, High, Medium, Low) if you have one.

• Acknowledgment: We will acknowledge receipt of your report within 5 business days.
• Updates: We will provide status updates as we investigate.
• Resolution: Once a fix is ready, we will coordinate disclosure with you before making any public announcement.

This policy applies to the latest published release of dbt-charts. If you are unsure whether a version is still supported, include the version details in your report and we will let you know.

We ask that you:

• Give us a reasonable amount of time to address the issue before making any public disclosure.
• Make a good-faith effort to avoid disrupting the project, its infrastructure, or its users during your research.
• Do not access, modify, or delete data that does not belong to you.

Only the latest published release of dbt-charts is supported with security fixes.

We appreciate the security research community's efforts in helping keep dbt Labs and our users safe. Responsible disclosure makes the open-source ecosystem stronger for everyone.

For urgent/critical issues, please reach out to the dbt Labs Security Team.