---
title: Report a Vulnerability
description: Security reporting and responsible disclosure
---

# Report a Vulnerability

See [SECURITY.md](https://github.com/basketikun/infinite-canvas/blob/main/SECURITY.md). Do not post exploit details, private API keys, sensitive screenshots, or real user data in a public issue.

Use GitHub private vulnerability reporting or a Security Advisory. If unavailable, email [1844025705@qq.com](mailto:1844025705@qq.com) with `[infinite-canvas security]` in the subject.

Include the affected version or commit, reproduction steps, impact and prerequisites, redacted logs or proof of concept, and whether browser storage, API keys, WebDAV, AI provider configuration, or network requests are involved.

The project prioritizes vulnerabilities caused by repository code or defaults, including XSS, sensitive-data exposure, file processing, import/export, WebDAV, access control, and supply-chain risks. Problems confined to third-party services, leaked user credentials, recommendations without an exploit path, phishing, and account recovery are normally outside scope.
