Report vulnerabilities through private vulnerability reporting. Include the REM version, platform, impact and reproduction steps. Remove secrets and personal data from attachments.

We triage security fixes for the latest published release. Use the most recent patch release of the Go toolchain when building from source.

The web app binds to IPv4 loopback and expects requests from a local browser. REM can reach public endpoints during investigations, and optional model providers receive evidence for report drafting. Keep credentials in your environment and store research outputs somewhere appropriate for their contents.