Report a vulnerability privately to contact@passioncode.ai, never in a public issue. Do not attach credentials, a working exploit or anyone's notes to an issue or a pull request.

What is in scope: the contract's schemas, profiles and conformance checker, and the fixtures a host is admitted by; a schema that lets a malformed or hostile message through is a vulnerability. Third-party components are reported to their own projects; tell us too if this repository ships the affected version.