Reporting a vulnerability

Do not open a public issue for a suspected vulnerability.

Report privately through GitHub:

https://github.com/blendsdk/openvault/security/advisories/new

Include:

• affected version or commit
• a description of the issue
• reproduction steps
• the impact you believe is possible
• any suggested fix

Do not include real secrets, private keys, tokens, or production hostnames. If a real secret may have leaked, rotate it first.

The full policy, including scope and response expectations, is in SECURITY.md. If a credential may already be in use, follow the incident response runbook before reporting.