Skip to main content
Security reporting needs a clear path.

​
What to include in a report

  • the affected area
  • reproduction steps
  • expected versus actual behavior
  • operational impact
  • sanitized logs or screenshots where useful

​
What not to do

Do not post active exploit details publicly before maintainers have had a chance to verify and address the issue. Keep the first report private, specific, and reproducible.
Last modified on March 6, 2026