Report a vulnerability

1. Use the project’s private vulnerability report on GitHub when it’s available (listed on this page). Only maintainers can see these reports.
2. If the project doesn’t accept private reports yet, open a GitHub issue that says only that you have a security report and asks for a private channel. Don’t include details, proof-of-concept code, or affected versions in a public issue.
3. For problems with the hideouts.io website itself, use the iOS Developer Toolkit private report link and say it concerns the website.

• The project, version or commit, and your macOS / iOS version and build.
• Steps to reproduce, expected result, and actual result.
• Impact as you understand it, kept to what you observed.

Never attach credentials, private keys, personal data, device backups, or unrestricted forensic evidence. Sanitize screenshots and logs first.

• An acknowledgement once the report has been read, and an honest assessment of whether it’s in scope.
• Coordination on a fix and a disclosure date before anything is made public.
• Credit in the release notes if you’d like it.

Good-faith research on your own devices and your own copies of these projects is welcome. Please don’t test against systems or devices you aren’t authorized to examine, access other people’s data, or degrade anyone’s service.

Machine-readable contact details are in /.well-known/security.txt.