Security

Reporting a vulnerability in Dummy Run

Use Report a vulnerability on this repository’s Security tab. Do not open a public issue. We reply within five working days and say what happens next.

We follow coordinated disclosure. We fix the problem in a private fork and then publish a GitHub security advisory with a CVE where one applies. The advisory credits you unless you ask us not to. We publish when the fix is released, or 90 days after your report if that comes first. Tell us if you need a different date.

Everything in this organisation is in scope. The apps Dummy Run tests and third-party model providers are not.

Findings about apps you do not own

A finding in someone else’s app belongs to its owner. Report it through their disclosure route, and keep it out of this project’s issues, discussions and example data.

What this repository holds

This repository holds no run results, screenshots, credentials or personas drawn from real customers. Run data stays with whoever runs Dummy Run.

Supported versions

Only main, until the first release.