If you discover a security issue in the Below280 openLCA IPC tools, please report it privately rather than opening a public issue.

Report via GitHub: go to the Security Advisories page for this repository and submit a private vulnerability report. This keeps the report within GitHub's secure disclosure workflow and avoids exposing details publicly.

Please include:

• A description of the vulnerability
• Steps to reproduce it
• The versions of openLCA, olca-ipc, and Python you were using
• Any relevant logs or screenshots

We will acknowledge your report within 5 working days and aim to provide a fix or mitigation within 30 days. We ask that you give us reasonable time to address the issue before any public disclosure.

This policy covers the Python scripts in this repository and their interaction with openLCA via IPC. It includes but is not limited to:

• Unintended modification of openLCA database contents (particularly the prospective parameterisation script)
• File path handling in CSV input/output
• Vulnerabilities in dependency handling

General bugs that do not have a security impact should be reported as normal issues.

Security fixes will be applied to the latest release on the main branch. We do not maintain older release branches at this time.