Report security issues privately.

Please do not publish an unpatched vulnerability, exploit detail, credential or private evidence in a public issue.

Preferred route

Once the fresh GitHub repository is public, use GitHub private vulnerability reporting for ruleoak/ruleoak and follow the repository SECURITY.md.

Include enough to reproduce safely

• affected RuleOak version/commit or release artifact;
• integration path and relevant environment versions;
• security impact and preconditions;
• minimal/sanitized reproduction;
• whether the issue crosses the documented security boundary.

Do not include

Third-party secrets, customer data, private source, unnecessary raw evidence or live destructive payloads.

Scope honesty

A behavior outside RuleOak's documented application-layer boundary may still be useful to report if documentation could be clearer, but it should not be described as an enforcement bypass when the action never crossed RuleOak.