Responsible disclosure
Report security concerns privately.
Please do not place suspected vulnerabilities, credentials, private data, or exploit details in a public issue.
Private security contact pending.
A private reporting destination will be added before the project is publicly announced.
A private reporting destination will be added before the project is publicly announced.
What to include
- The affected JSForm version and component
- A concise description of the impact
- Safe reproduction steps or a minimal example
- Any known mitigation
Receipt, assessment, and coordinated disclosure expectations will be published with the public repository.