cyberwitchery builds security and networking tooling. if you find a hole in any of it, we want to hear about it.

for a public repo, use github’s private vulnerability reporting: open the repo’s security tab and file it there. it’s on for every public repo in the org.

for our commercial products, or anything you can’t reach on github, email contact@cyberwitchery.com.

either way, tell us what you found and, where you can, how to reproduce it. please don’t open a public issue for a security bug.

we acknowledge every report within 5 business days, work through it with you, and keep you posted while a fix is in flight. we ask for 60 days from your report before anything goes public, and publish an advisory once the fix ships.

we fix security bugs in the latest release. older releases don’t get backports.

there’s no bug bounty and no money on offer. we’ll gladly credit you in the advisory if you’d like.

every repo under the cyberwitchery org, and our commercial products. forks of other projects are out of scope: report those upstream.