Email security@curf.ai with a description, the version (EXPORT.txt in the repo root, or Admin → Release log in the app), and steps to reproduce. Do not open a public issue.

We acknowledge within two business days, keep you informed while we fix it, and credit you in the release notes unless you prefer otherwise.

The latest release on main is supported. Fixes ship as a new release; we do not backport.

In scope: this repository's code and its default configuration. Out of scope: vulnerabilities in third-party dependencies already reported upstream, and issues that require an attacker to already hold an admin session or API key for the workspace they attack.