Please do not report suspected vulnerabilities in a public issue.
Use GitHub private vulnerability reporting when available. Otherwise contact LibreCode Coop at contact@librecode.coop.
Do not publish credentials, tokens, private keys, customer data or exploit details in public discussions.
Reusable workflows should follow these controls:
- pin third-party Actions to immutable commit SHAs;
- keep credentials in consumer-owned protected environments;
- use minimum GitHub token permissions;
- avoid privileged execution of untrusted pull request code;
- keep planning non-mutating by default;
- require explicit invocation for publication or other mutations.