Skip to content

Report a Vulnerability

Do not post exploit details, credentials, customer data, or an unpatched vulnerability in a public issue or discussion.

Use GitHub's private vulnerability-reporting flow:

Open a private security advisory

If private reporting is unavailable, open a minimal public issue asking the maintainers to provide a private contact channel. Include no sensitive technical details in that issue.

A useful private report contains:

  • affected version, commit, and deployment shape;
  • prerequisites and the smallest reproducible sequence;
  • observed and expected behavior;
  • security impact and affected trust boundary;
  • sanitized logs or proof of concept; and
  • any known workaround or evidence of active exploitation.

Maintainers should acknowledge the report through the private channel, reproduce and triage it, coordinate a fix and disclosure, and credit the reporter if desired. The project does not publish a fixed response-time SLA; avoid making remediation plans that assume one.

The repository policy is also available in SECURITY.md.