Report a security issue

Baseline assessment tool

For vulnerabilities in the tool, such as cross-site scripting, imported-file handling, or assessment data leakage, use a private GitHub vulnerability report or email security@teloa.ai. Suggestions and disagreements about baseline requirements belong in ordinary public issues.

Teloa Community

By default, report sanitized security concerns and public evidence in a public issue. For remote code execution, large-scale credential leakage, or access to user privacy, start with private email and use the fixed-field template in the project’s SECURITY.md.

Marketplace and ecosystem projects

Identify the resource, source, version, and repository involved. Do not include live credentials, private user data, or directly exploitable payloads in public reports. Provide sensitive details through email.

What to include

• Affected product, resource, version, or commit.
• Expected behavior, actual behavior, and minimal sanitized reproduction steps.
• Impact, affected components, and your severity assessment.
• A contact for follow-up, and whether you prefer anonymous credit.

Supported versions and response commitments are defined by each project’s security policy.