Email your report to security@ipfs.io. Please do not open a public issue.

Include whatever you have: the page or commit affected, how to reproduce the problem, and what an attacker gets out of it. A rough report is better than no report, and we will ask if we need more.

A maintainer will confirm we received it and keep you posted while we work on a fix. We are glad to credit you, or to leave you unnamed if you would rather not be credited.

If two weeks pass and no human has replied, assume the message never reached one. Resend it, or escalate: the OpenSSF finder guide lays out the options, and CERT/CC takes reports when coordination with a project breaks down. We would rather you do that than sit on a live bug.

Malware, phishing, illegal content, and takedown requests are not vulnerability reports, and this repository is not where they get handled. Use the abuse form or email abuse@ipfs.io. The Reporting Abuse section of the site explains what to include.

For normal bugs in this site, open an issue.

This repository follows the IPFS project security policy.