Use GitHub's private vulnerability reporting on the affected repository: open its Security tab → Report a vulnerability. That channel is private between you and the maintainer, and it creates a tracked advisory rather than a public issue.
Please do not open a public issue for a suspected vulnerability. A public issue is the disclosure, and it happens before there is a fix.
- What you did, and what happened that should not have.
- The repository and, where you can, the file or endpoint.
- Whether you needed any access to reach it (unauthenticated, a token, local code execution) — this is usually the difference between a finding and an incident.
| Acknowledgement | Within 5 working days |
| Initial assessment | Within 10 working days |
| Fix or a stated decision not to | Communicated on the advisory, with reasons |
These are commitments about communication, not about a fix date. If a report turns out to be a design decision rather than a defect, you will be told that and why, rather than left waiting.
Every repository in this organization. Several are research or reference code published for transparency and are not deployed anywhere — a finding in one of those is still worth reporting, and the response will say which category it falls into.
Testing against your own copy is always fine. Do not test against live infrastructure, exfiltrate data, or degrade a service. Good-faith research reported through the channel above will not be pursued.