Report privately. Fix deliberately.
Effective date: September 21, 2026. We welcome good-faith security research affecting Last Refuge projects or this site.
How to report
Use the Contact page and include “Security report” in the subject, a clear description, reproduction steps, impact, and any suggested mitigation. Please do not publish details until we have had a reasonable opportunity to investigate and coordinate a fix.
Safe harbor
We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us a reasonable opportunity to remediate. Do not access data that is not yours, degrade availability, or use social engineering.
Updates
Supported-version and release information is published with each project. We may acknowledge reporters where appropriate and with permission.