Reporting a vulnerability
We take security seriously and appreciate responsible disclosure. If you've found a vulnerability in the framework, an official plugin, or this site, please tell us before disclosing it publicly.
How to report
Use the report form with the "Security vulnerability" category, or open a private advisory on GitHub. Include steps to reproduce and the affected version.
What to expect
We acknowledge reports as quickly as we can, keep you updated on the fix, and credit reporters who want it. Please give us a reasonable window to ship a fix before disclosing.
Scope
The framework crates, the official plugins, and this website. Community plugins in the directory are maintained by their authors — flag a malicious or vulnerable one with the report form and we'll review it.
Secure by default
Umbral ships CSRF protection, clickjacking + HSTS headers, template auto-escaping, and always-parameterized SQL. See the feature catalog for the full list.