Email info@buildinghumanetech.com with "SECURITY" in the subject. Do not open a public issue for anything involving secrets, tokens or a way to make the action run untrusted code.

We aim to acknowledge within 5 business days and respond with a plan within 14 days.

In scope: this action's code, workflow handling of pull request data, and anything that could expose your API key or a diff. Out of scope: fork pull requests, which v1 does not support by design (see the Security section of the README), and findings the check gets wrong.

Supported: the latest v1 tag.