Please report suspected vulnerabilities privately. Include the affected package and version, impact, reproduction steps, and any suggested mitigation. Remove credentials and personal data from attachments.

Use GitHub's Security → Report a vulnerability when private vulnerability reporting is available. Otherwise contact the maintainer at ajay.kumar@nonstopio.com with the subject “Flutter Forge security report”. This is the maintainer contact listed in the repository metadata. Do not open a public issue with exploit details.

Maintainers prioritize fixes on the latest release of an affected package. Older versions are assessed case by case; no response-time or backport guarantee is made. We will coordinate disclosure after assessing the report and preparing an appropriate fix.

Repository administrators should enable Settings → Code security → Private vulnerability reporting so reports can be handled through GitHub advisories.