Do not publish vulnerability details, exploit code, credentials, private keys, or email action tokens in public issues or pull requests.

Use GitHub's Report a vulnerability option in this repository's Security tab if it is available. This option depends on the owner enabling private vulnerability reporting. If it is unavailable, open an issue titled “Request a private security contact” with no vulnerability details, and wait for the maintainer to provide a private channel before sharing the report.

In the private report, include the affected commit, the impact, reproduction steps using synthetic data, and any suggested mitigation. Redact secrets and personal data. Do not test against systems or accounts you do not own or have explicit permission to assess.

ReplyTrail is preparing its first deployed release. There is no published security-support window, guaranteed response time, or bug-bounty program. Report the affected version even if it is older; review and fixes are handled as maintainer capacity permits.