Use GitHub private vulnerability reporting: open the Security tab of n0nuser/goodcodereview and choose Report a vulnerability. Do not open a public issue for a vulnerability.

In scope:

• The Python tools in tools/, such as validate.py and build.py.
• The Worker in src/worker.js, which answers filtered requests and paths that match no file.
• The workflows in .github/workflows/.
• The site build and its output, such as injected markup in generated pages.

Out of scope:

• Disagreement with a card's advice. Open a card correction instead.
• Vulnerabilities in third-party tools that the cards mention.

Only the main branch is supported.