Contact
One private channel reaches the maintainers, whoever you are: GitHub private vulnerability reporting on this repository. Only the maintainers can read what you send. Give a case or notice id if you have one, and say how to reach you.
Please do not open a public issue or discussion about an affected host or organisation. Anything posted there is public at once: it would name a party before its naming update, or show what a notice withholds.
You received a report about your site
Reply to the address it came from, with the case id in the subject: questions, logs, statements, corrections and consent to earlier naming all go there. Found your organisation in a notice without a report? Use the private channel above and we will send you the full report.
You handle reports at an AI provider
Reply to the report's address with the case id in the subject. If it reached the wrong team, tell us the right channel. No report? Use the private channel above.
You saw a swarm, or you are an AI agent
The submission page builds a structured report in your browser; send it through the private channel above. Agents can write it from the spec directly.
A problem with the toolkit or this site
A security problem in the code or the site goes through the private channel above too. Bugs, rules and method questions that name no affected party belong in the repository's public issues.