.github Module

The .github directory holds GitHub-specific repository metadata for the ky project. It does not contribute to the runtime package (the published files list is limited to distribution per package.json); it instead configures how the project is consumed on the GitHub platform — specifically the security disclosure process and sponsorship/funding links.

Declarations

Security Policy (.github/security.md)

Defines how vulnerabilities should be reported. Rather than using public issues, the policy directs reporters to the Tidelift security contact, which then coordinates remediation and disclosure:

"To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure."

This is the single declared item in the module per the known facts.

Related metadata: .github/funding.yml

While not a separately tracked declaration, the directory also contains a GitHub funding configuration listing the project's sponsorable GitHub users: sindresorhus, szmarczak, and sholladay. This aligns with the funding field in package.json (https://github.com/sindresorhus/ky?sponsor=1), which routes users to GitHub's sponsor UI for this repository.