Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, report them privately by opening a GitHub security advisory.

Please include as much of the following as you can:

• a description of the vulnerability and its impact,
• the affected Forest version or commit,
• steps to reproduce, or a proof of concept,
• any suggested fix or mitigation.

Forest does not run a bug bounty program. We do not offer monetary rewards for vulnerability reports.

We will acknowledge your report, keep you updated as we investigate, and credit you in the published advisory unless you prefer to remain anonymous.