Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting on the affected repository (Security tab, "Report a vulnerability"). Do not open public issues or pull requests for security reports.

We aim to acknowledge reports within 72 hours. Please include reproduction steps, affected versions or commits, and impact.

This policy covers all repositories in the customermates organization, including the Customermates product and the n8n community integration. Secrets exposed in any repository should also be reported through the same private channel.