Report a vulnerability privately: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue for it.

Say what you found, how to reproduce it, and which commit you tested.

vawe renders pages on your own machine in headless Chrome. A report about a page that escapes the renderer, reads files it should not, or reaches the network during a render is in scope.