Please report suspected vulnerabilities privately by emailing elroy@spectrasynq.com.
Do not open a public GitHub issue for vulnerabilities, exposed credentials, or anything that could put users, infrastructure, or unreleased product work at risk.
Include:
- The affected repository or surface
- A short description of the issue
- Reproduction steps or proof-of-concept details, if safe to share
- Any logs, screenshots, or commits that help locate the problem
We will review reports as soon as practical, coordinate fixes privately where needed, and publish public details only after the immediate risk is handled.
SpectraSynq does not currently run a paid bug bounty programme.