Report security or privacy issues privately to devs@put.io. Do not open a public issue, pull request, or discussion for them.

• the affected repository, app, or package, and the version or commit
• the impact: what an attacker can read, change, or reach
• minimal steps to reproduce
• any mitigation you know of

• test only against accounts and data you control
• keep testing non-destructive and low-volume

Reports apply to the current default branch and latest release unless a repository says otherwise. Allow time to investigate and fix before sharing details publicly.