Legal / Security

Security policy

How to report a security concern responsibly.

Responsible disclosure

Do not publish sensitive vulnerability details publicly before the project has had a reasonable opportunity to investigate. Contact UmarJaum through the official GitHub repository or the contact page with a clear reproduction path.

What to include

Never include passwords, access tokens, private keys or personal data in a report. We may ask for a safe test case and affected version.