Do not report a vulnerability in an issue, pull request, or discussion.

Submit a report through GitHub private vulnerability reporting or email security@fluxer.com. Include the affected component, impact, reproduction steps, and supporting evidence. Remove unrelated personal data and secrets.

The programme scope, testing rules, safe harbour, disclosure process, and reward terms are published at https://fluxer.app/security. That page is authoritative.