Security
Report security concerns without publishing them.
Security issues, credentials and sensitive system details do not belong in public issues, discussions or demonstrations.
Before reporting
Do not include personal data, live credentials, exploit details or confidential information in a public channel. Do not test against systems or accounts without explicit authority.
Current reporting route
Follow the security instructions in the public repository security policy. If a suitable private reporting route is not yet available, retain the details and open only a minimal public issue asking the maintainers to establish private contact.
Demonstrator boundaries
Demonstrators use synthetic data and simulated external interfaces. A credible confidentiality, privacy, security, legal or safety concern is sufficient reason to stop publication or demonstration until it has been examined.