Report a vulnerability without making it public.
Security reports deserve a private route, exact release context, and careful handling. This page never asks for credentials or a synthetic email test.
Private reporting route
Use GitHub's private vulnerability reporting or security advisory route for the release repository when it is enabled. If the private route is unavailable, do not publish exploit details in a public issue. Preserve the report and use a verified private owner channel once one is published.
Report contents
- Affected release, commit or artifact checksum, and operating system.
- Impact assessment and the smallest reproducible steps.
- Mitigation idea, if known, and any safe disclosure constraints.
- A safe contact path, with credentials, access tokens, personal data, and customer files removed.
Current security posture
- Static public pages contain no checkout, account, analytics, or contact form.
- Public API routes are intended to be loopback-proxied, path allowlisted, body-limited, and fail closed for billing.
- Managed AI is Workcell-managed only; provider, region, retention, deletion, training, and entitlement behavior must be verified before cutover.
- Simulation does not control physical systems and is not safety certification.
Triage and disclosure
Reports are acknowledged and assessed as capacity permits. A fix or mitigation may be published after coordinated review. No bounty, response time, or public-disclosure date is promised by this release notice. A report does not authorise access to another person's system.
Identity and scope
The seller/publisher is Denis Miclea, an individual developer in Quebec, Canada. Do not send a residential address, tax identity, secret, or customer material in a public issue. General questions belong on support.