Security reporting
Private routing guidance for suspected vulnerabilities and security-sensitive operational reports.
Read the page as a transparent path: establish context, inspect the evidence, then test the published stance.
Do not disclose a vulnerability publicly
Do not place exploit details, credentials, personal data, tokens, private repository information, or proof-of-concept payloads in GitHub Issues, Discussions, comments, research submissions, or the administrative contact form.
The production encrypted security-reporting route will be activated only after an accountable recipient, access controls, retention schedule, acknowledgement process, and incident playbook are approved. Until then, this site does not accept vulnerability details. You may report only that you need the private route through administrative contact, without describing the vulnerability.
Reports will be minimized, restricted to incident responders, encrypted in transit and storage, excluded from normal application logs, and deleted according to the approved incident and legal-retention policy. Publication, attribution, embargo, and coordinated disclosure are agreed case by case; no bounty is implied.
Source record
Bibliography
No external sources are required for this administrative page.
Known limits
Unresolved unknowns
- The production encrypted disclosure endpoint and response service level require owner approval before launch.
Public review
Discuss and correct
Comments are public. Proposed factual corrections must be incorporated into version-controlled research before they are treated as published.
Local preview does not have Giscus configured. Native comments and Giscus are never presented as competing primary systems on the same page.