Found something in RedirX itself? Open a private security advisory via GitHub (Security → Advisories → New draft advisory) rather than a public issue. You'll get credit in the release notes if you want it.

Scope: code execution, path traversal in output handling, credential leakage through logs/output, and dependency CVEs with practical impact. Feature requests are not vulnerabilities.

RedirX sends attack payloads to targets you point it at. Only scan infrastructure you own or have written authorization to test. You are responsible for complying with applicable laws.