Do not report security vulnerabilities through GitHub issues, pull requests, discussions, public comments, or unsecured email.

To report a vulnerability involving this repository, use the private Report a vulnerability option on the repository's Security tab.

You may also submit a report through the HHS vulnerability disclosure portal. Reports may be submitted anonymously.

Before conducting security research, review the HHS Vulnerability Disclosure Policy to understand which systems and research activities are authorized.

If you encounter credentials, access tokens, personally identifiable information, production data, or other sensitive information, stop testing and report the issue through one of the private channels above as soon as possible.