Report an unpatched vulnerability privately. Do not put exploit details, credentials, or private project data in a public issue.

Use this repository's Security → Report a vulnerability option when private vulnerability reporting is enabled. If that option is unavailable, open an issue only to request a private contact channel, without vulnerability details.

In the private report, include the affected Rivet version, Android version, reproduction steps, and expected versus observed behavior. Redact secrets and use a disposable project for examples. No bug bounty or response deadline is promised.