---
title: "Report a Vulnerability"
url: "https://docs.caracal.run/v1.0/security/disclosure/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/security/disclosure.md"
description: "Submit a suspected vulnerability through the private channel appropriate to its scope."
page_type: "workflow"
concepts: []
requires: []
---

# Report a Vulnerability

Canonical URL: https://docs.caracal.run/v1.0/security/disclosure/
Markdown URL: https://docs.caracal.run/markdown/v1.0/security/disclosure.md
Description: Submit a suspected vulnerability through the private channel appropriate to its scope.
Page type: workflow
Concepts: none
Requires: none

---

Do not open public issues or pull requests for credential exposure, policy bypass, unsafe execution/routing, audit compromise, malicious artifacts, or exploitable failures.

## Choose a Channel

| Scope | Channel |
| --- | --- |
| OSS code | `https://github.com/Garudex-Labs/caracal/security/advisories/new` |
| Sensitive attachments/context | `support@caracal.run` |
| Enterprise-only/private customer context | Email only; outside this workspace |

## Report Procedure

Include summary, version/commit, boundary, prerequisites, minimal reproduction, observed/expected, impact, and mitigation if known. Redact credentials/customer data.

Maintainers aim to respond within up to seven days; this is not a resolution SLA.

## Verify Submission

Retain identifier and sanitized copy. Continue through the same private channel.

## Recovery and Disclosure

Keep private until fix/mitigation or coordinated outcome. For active exploitation, contain with [Respond to Incidents](/v1.0/operations/incident-response/).

## Next Step

Review [Review the Threat Model](/v1.0/security/threat-model/).