---
name: ⚠️ Security report (PUBLIC, read first)
about: DO NOT use this template for an unpatched vulnerability.
title: ""
labels: ""
---
🚨 **STOP.** If you're reporting an unpatched vulnerability, this
template is **not** the right place, public issues are visible to
everyone before a patch is ready.
Use the **private** disclosure channel instead:
1. **Preferred**: GitHub Security Advisory at
https://github.com/santhreal/captchaforge/security/advisories
→ click "Report a vulnerability"
2. **Alternative**: email security@santh.dev
See [.github/SECURITY_BOUNTY.md](../SECURITY_BOUNTY.md) for scope,
process, and SLOs.
---
If you're SURE the issue is safely public (already patched, or a
non-security concern), you can convert this to a regular bug
report. Otherwise close this and use the private channels above.