Repositories published under this organization and the site at refpath.io are in scope. Forks and modified deployments are not.

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting on the affected repository, or email hello@refpath.io with the affected repository, file, or URL, steps to reproduce, and the impact you expect. Strip secrets from logs and screenshots.

Reports are read and answered as time allows, with no response-time promise and no bounty. Please allow a fix to be released before publishing. Do not access data that is not yours or test denial of service.