The only completely secure system is the one that doesn't exist in the first place. Having said that, we take security seriously.

Please disclose potential security issues privately to the security team (@8fold/security-team) — a GitHub security advisory on this repository (Security tab → Report a vulnerability) is the preferred channel, since it keeps the report private until a fix lands. We will provide an initial assessment of security reports within 72 hours and should apply patches within 2 weeks (also, feel free to contribute a fix for the issue).