If you find a security issue in a rubyatscale project, please do not open a public issue. Email security@gusto.com with a description and reproduction steps. We will acknowledge within two business days.
Include the following details in your report:
- The affected project and version
- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact
- Suggested fix (if any)
In scope:
- The gems, CLIs, VS Code extensions, and GitHub Action in the rubyatscale organization
Out of scope:
- Gusto product bugs (report at gusto.com/security)
- Issues in upstream dependencies, such as packwerk or Rails, without a rubyatscale-specific exploit path