Two ways, both reaching the same people:

• Email open@codrlabs.com.
• Or use GitHub's private vulnerability reporting on the affected repository: Security → Report a vulnerability.

Please do not open a public issue for a vulnerability. That publishes it before anyone can fix it.

Useful in a report: which repository and which commit or version, what an attacker could do with it, and the steps to reproduce. A short proof of concept helps. A raw scanner report usually does not.

These are open, mentoring-driven projects rather than a funded security team, so here is the honest version: we aim to acknowledge a report within a few working days, and we will tell you whether we agree it is a vulnerability and what we intend to do about it. If a fix lands, you are credited unless you would rather not be. There is no bounty programme.

Repositories under github.com/codrlabs and the sites they publish, such as open.codrlabs.com.

Anything else on codrlabs.com is a separate system that is not covered by this policy — contact Codrlabs directly for those.

Please do not test against anything you do not own: no automated scanning of live sites, no denial of service, and nothing touching other people's data.

If you find a live credential in a repository, in a published build, or in the git history, report it — do not test it to see whether it works.

Credentials are rotated first and cleaned out of history second. A secret that reached a public repository is compromised the moment it was pushed, because the old commits stay reachable by their SHA and existing clones and forks keep their own copies. Rewriting history does not un-publish anything.

More on how we handle this: Secrets and accounts.