Reporting vulnerabilities

Report security issues privately. Do not open public GitHub issues for vulnerabilities that could put operators or users at risk. The channel and response expectations are in SECURITY.md.

Include:

• The affected version or commit
• Steps to reproduce, on loopback if possible
• The impact, such as authentication bypass, capability escalation or secret leakage

See the security model for the guarantees bobby aims to hold.