Report security problems in Rust CVE Sniffer itself separately from dependency advisories found in a scanned project.

Use GitHub's “Report a vulnerability” option on this repository's Security page if it is available. If it is unavailable, open an issue asking the maintainer for a private reporting channel without including exploit details, credentials, private lockfiles, or other sensitive data. Do not assume ordinary issues are private.

Include the affected component and version or commit, expected and observed behavior, impact, and a minimal reproduction using synthetic or public data. Do not test against other people's projects or systems without permission.

The public browser scanner, CLI, desktop application, advisory update pipeline, and local Docker preview are distinct components. Identify which is affected. The Docker preview is not the public website architecture.

Privacy leaks, unsafe handling of untrusted input, advisory integrity failures, resource-limit bypasses, and incorrect result suppression are relevant reports. A known dependency advisory match is not by itself evidence that the scanner is exploitable.

This file does not establish a bounty, response deadline, guaranteed support window, or new security exclusions.