In scope
First-party scanner, console, authorization, queue, evidence, signing, release verification, storage, and built-in plugins.
RESPONSIBLE DISCLOSURE
Report security issues privately.
The repository policy asks researchers to avoid public disclosure before coordinated remediation.
Email the security contactSafe research
- test only owned or authorized systems
- do not access other people’s data or degrade service
- preserve evidence and reproducible steps
- do not publish secrets or tokens