Vulnerability disclosure
How to report a security vulnerability in Notploy responsibly.
Purpose — Give security researchers and users a clear, private channel to report vulnerabilities, and set expectations for how reports are handled.
Do not open a public issue
Security vulnerabilities must not be reported through public GitHub issues, Discord, or any other public channel. A public report exposes every running installation before a fix exists.
How to report
Follow the private reporting instructions in the repository's SECURITY.md. Use the security advisory / private reporting feature of the GitHub repository.
Include, where possible:
- a description of the issue and its impact,
- the affected version(s) and edition,
- steps to reproduce, with a minimal proof of concept,
- any suggested remediation.
What to expect
- Acknowledgement of the report.
- Assessment and, if confirmed, a fix in a released version.
- Coordination on disclosure timing so users have time to update.
Please give maintainers a reasonable window to investigate and ship a fix before any public disclosure.
Scope
In scope: the Notploy platform, its API, CLI, SDK, MCP server and official images. Out of scope: vulnerabilities in third-party software you deploy with Notploy, or in the infrastructure you provide.