Report vulnerabilities privately, through GitHub's private vulnerability reporting:

1. Open the Security tab of the repository.
2. Choose Report a vulnerability and describe the problem: what is affected, how to reproduce it, and what an attacker could do with it.

Please do not open a public issue or discussion for a vulnerability, and do not include real credentials in a report. If you cannot use the form, email support@eyelock.net.

You can expect an acknowledgement within a few days. The maintainer will confirm the problem, work on a fix, and agree a disclosure date with you before publishing an advisory.

Fixes are made on the latest release. Older releases are not patched.

ynf runs agents against repositories and holds tokens for the forges and trackers it talks to. Reports about containment, token handling, and what a run can reach are in scope.