If you discover a security vulnerability in Runner Guard, please report it through GitHub's private vulnerability reporting:

Report a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

We will acknowledge receipt within 24 hours and provide an initial assessment within 72 hours.

This policy covers:

• The Runner Guard CLI tool
• The Runner Guard GitHub Action
• The Runner Guard Docker image
• Detection rules and threat signatures

We appreciate responsible disclosure and will credit reporters in release notes unless anonymity is requested.