Report vulnerabilities privately! Do not open a public GitHub issue OR a Discord #code-bug-report.

Join the CMU Discord and privately message someone with a code maintainer role or addressed to the host(s).

In any case, do not publicly disclose the vulnerability until we have fixed it or explicitly given you permission to do so.

Vulnerabilities in the engine (RobustToolbox) or in code inherited unchanged from RMC14 or Space Station 14 will usually be fixed upstream. Reporting those directly to the Space Wizards at support@spacestation14.com works too as it will help other communities.