Disclosure

Report a vulnerability

Email support@ghosthue.com with the affected component and a reproduction that does not include live customer data. Do not open a public issue for production-impacting vulnerabilities.

Scope

• ghosthue.com web application and API
• Release signing, verification, and Preserve records
• GitHub Action and provider adapters
• Seal protocol and Sentinel agent, when published

What to include

• Affected component
• Reproduction that does not include live customer data
• Expected versus observed behavior

Prohibited testing

Do not access other customers’ data, attack production availability, probe private networks, or use stolen credentials. Destructive testing is out of scope.

Safe harbor

Draft pending legal review. GhostHue intends not to take legal action against good-faith research that follows this process and avoids accessing other customers’ data, private networks, or non-public credentials.