Please do not report security vulnerabilities through public GitHub issues or public discussions.

If GitHub Private Vulnerability Reporting is enabled for this repository, please use it to submit your report. If it is not available, please contact the project maintainers through a private security contact mechanism associated with the repository or the Yandex organization.

Please include as much of the following information as possible:

• A clear description of the vulnerability.
• The affected Odyssey version, release, branch, or commit.
• Steps to reproduce the issue.
• The expected and actual behavior.
• The potential security impact.
• A minimal proof of concept, if available.
• Relevant logs, configuration, or crash information, after removing sensitive data.
• A proposed fix or mitigation, if you have one.

Please avoid including credentials, production data, or other confidential information in the report.

Security fixes are considered for actively maintained branches and releases. The project may not be able to provide security fixes for obsolete or unsupported versions.

If you are unsure whether a version is affected, report the issue with the exact version or commit information so that the maintainers can investigate.

Please allow the maintainers reasonable time to investigate and coordinate a fix before disclosing the vulnerability publicly.

After a fix or mitigation is available, the maintainers may publish additional information about the issue, affected versions, and recommended upgrade or mitigation steps.

The maintainers will acknowledge receipt of a security report when possible and may request additional information during the investigation. The timing and scope of further communication depend on the severity and complexity of the issue.

Thank you for helping keep Odyssey and its users secure.