Report privately through a GitHub security advisory. Please do not open a public issue for a vulnerability first — a public report is a disclosure, and it starts the clock before there is a fix.

Useful reports say what you did, what you expected, and what happened instead. A proof of concept helps enormously; so does the browser and version, since much of this project's security surface is the browser's.

Expect an acknowledgement within a week. If a report is valid you will be credited in the release notes unless you would rather not be.

TerraVisual runs entirely in the browser, so the interesting reports are about what the page itself can be made to do:

• anything that makes the application send a user's Terraform anywhere;
• anything that escapes the workspace — a path, a module source, or a share link that reaches outside it;
• anything that executes attacker-controlled code in the page, including a bypass of the Content Security Policy;
• input that hangs or crashes the analyzer in a way the limits should have prevented;
• a security header that is missing or weakened on the deployed site.

• Browser extensions. An extension the user installs has permission to read every page, and Chrome exempts extension scripts from a page's CSP. No website can prevent this.
• A share link being readable by whoever holds it. A link contains the workspace — that is how sharing works without a server, and the interface says so before the link is copied.
• Terraform that describes insecure infrastructure. TerraVisual draws what the code says. Telling you the code is unwise is a feature request, not a vulnerability.
• Reports generated by a scanner with no demonstrated impact, missing headers on responses that carry no content, and volumetric denial of service against the public site.

The deployed site is the supported version. Fixes go to the live deployment; there are no maintained release branches.

Every pull request runs dependency vulnerability scanning across the JavaScript and Go modules, and every deployment verifies its own security headers against a real response rather than against configuration. The seven-control baseline audits live in docs/security/, blind spots included.