Report a vulnerability
Email a clear description, affected component, reproduction steps, and potential impact to [email protected]. Include logs or proof-of-concept code when useful, but do not include secrets or personal data you do not need to share.
Send a reportWhat you can expect
We will acknowledge a good-faith report as soon as practical, investigate it, and keep you informed when we have meaningful updates. We will work with you on a reasonable disclosure timeline and credit you if you want to be recognized. We do not currently offer guaranteed bounty payments.
Safe harbor
We will not pursue legal action against good-faith research that follows this policy. Research should avoid privacy violations, service disruption, social engineering, physical attacks, denial of service, automated traffic that degrades the service, and accessing or retaining more data than is necessary to demonstrate the issue. Stop testing and notify us immediately if you encounter user data, credentials, or other sensitive information.
Scope
Reports about our hosted web properties, APIs, authentication flows, registry, CLI, SDK, and maintained repositories are welcome. Findings that only affect unsupported dependencies, require implausible user interaction, or are limited to missing best-practice headers without demonstrated impact may not qualify as vulnerabilities.
Coordinated disclosure
Please give us a reasonable opportunity to investigate and remediate a report before publishing it. Do not open a public issue for an unpatched vulnerability or disclose details that would put users at risk.