To report a vulnerability in core-recon-passive, please use GitHub Private Vulnerability Reporting.

This ensures your report is handled confidentially and does not expose the vulnerability publicly before a fix is available.

• Initial response: Within 24 hours of submission
• Status updates: You will be kept informed as the report is reviewed
• If accepted: We will work on a fix and coordinate disclosure with you
• If declined: We will explain why the report does not qualify as a vulnerability

We appreciate responsible disclosure and thank you for helping keep this project secure.