Shinken is a research/runtime project for computer-use agents. This document describes how to report a vulnerability.

Please do not open a public issue for security problems. Instead, use GitHub's private vulnerability reporting ("Report a vulnerability" under the Security tab). We aim to acknowledge reports within a few days.

When reporting, include: affected version/commit, a description and impact, reproduction steps, and any logs that help.

We follow coordinated disclosure: we will work with you on a fix and a disclosure timeline before any public advisory.