Do not report security vulnerabilities through public GitHub issues.
Preferred reporting method:
- Use GitHub’s private vulnerability reporting / Security Advisories for the affected repository (when enabled), and follow that repo’s
SECURITY.mdif present.
If private vulnerability reporting is not available for a repository:
- Open a minimal public issue without exploit details and state that you can provide additional information privately to maintainers.
This organization contains research and engineering artifacts. Each repository may define additional scope and response expectations.