RHEL-LAB is a defensive research workspace. Authorization covers only systems independently owned by, or explicitly made available to, the operator. Nothing here grants permission to test Red Hat websites, infrastructure, or third-party systems.

Do not open a public GitHub issue or PR describing an unpatched vulnerability, exploit procedure, security-sensitive crash reproducer, customer data, or credentials.

• For suspected Red Hat product security defects, use Red Hat's official private product-security reporting instructions (including the Red Hat Product Security contact, secalert@redhat.com, where appropriate). Confirm current vendor instructions before sending.
• For vulnerabilities in RHEL-LAB's own tooling, privately contact the maintainers through an agreed non-public channel before publishing technical details.
• Include minimal reproducible steps, affected versions, sanitized logs, impact boundaries, and a clear distinction between observed facts and hypotheses.
• Coordinate publication and retain an evidence trail of the communication. Never imply that a vendor has confirmed a finding without a documented response.

Security controls for this repository are summarized in AGENTS.md and docs/RESEARCH_PROTOCOL.md.