Exploit Command Center is a client-side-only application. There is no backend server, no authentication layer, and no data transmitted to any remote host. All state — including payload rendering, variable resolution, execution history, and favorites — lives exclusively in the user's browser. This shapes the attack surface significantly, and reports should be calibrated accordingly.

Use GitHub's private security advisory system to submit a report. This keeps the disclosure confidential while the issue is assessed and patched.

A useful report contains:

1. A clear description of the vulnerability — what it is and where it exists
2. The component or file affected (e.g., the AST renderer, the Zustand store, a specific compiler validation step)
3. Step-by-step reproduction instructions if you can
4. What an attacker can achieve by exploiting it (impact)