Report security or privacy issues privately to devs@put.io. Do not open a public issue, pull request, or discussion for them.
- the affected repository, app, or package, and the version or commit
- the impact: what an attacker can read, change, or reach
- minimal steps to reproduce
- any mitigation you know of
- test only against accounts and data you control
- keep testing non-destructive and low-volume
Reports apply to the current default branch and latest release unless a repository says otherwise. Allow time to investigate and fix before sharing details publicly.