A reporting limitation worth stating clearly#
Use an already trusted private channel to the owner. When no such channel is available, ask the maintainer how to establish one without disclosing the vulnerability. Check the repository for a newer security policy before sending details.
Check repository security informationWhat helps once a private channel is established#
Provide the affected source revision or artifact identity, the security boundary involved, safe reproduction steps and the expected versus observed behaviour. Keep reproduction fixtures synthetic where possible.
Do not casually send credentials, private keys, complete profiles, browsing history, DNS questions or other people’s data. Agree on a safe transfer method for genuinely necessary sensitive evidence.
Website issues versus VPN issues#
Identify whether a finding concerns this static website, the supplied design demonstration, the Android client, the Kurd runtime or a particular owner-operated deployment. They are not the same security boundary.
This guidance does not promise a response deadline or permission to test somebody else’s deployment.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.