Report suspected Slop vulnerabilities through GitHub private vulnerability reporting. Reports are shared privately with the repository's security maintainers. Do not open a public issue or pull request containing an unpatched vulnerability.

Include the affected component or URL, revision if known, reproduction steps, expected and observed behavior, and the potential impact. Use a minimal example with synthetic data. Never include credentials, signing material, private traces, or another person's private data.

Maintainers will assess the report and coordinate remediation and disclosure through the private advisory. A report does not establish reward eligibility or payment approval. Ordinary bugs and feature requests belong in public GitHub issues.