Security reporting
How to report a vulnerability privately and where to read about sandbox and secrets configuration.
Report a vulnerability
Use GitHub private vulnerability reporting from the repository Security tab. Do not report vulnerabilities in public issues, discussions, or pull requests. Include the issue and impact, reproduction steps, affected component and version or commit, and relevant configuration.
Response and supported versions
The project aims to acknowledge reports within a few business days. Please allow a reasonable window for a fix before public disclosure and mention if you would like credit. Fixes target the latest main and the most recent release.
Explore the security documentation
The security policy identifies sandbox escape, credential exposure, tenant isolation, authorization bypass, and injection as areas of interest. Consult the configuration documentation for the boundaries of your deployment.