Security
Reporting a vulnerability
If you find a way around ForgeVigil’s safety rules, we want to hear about it.
How to report
Please report privately through GitHub’s private vulnerability reporting for the ForgeVigil repository. Don’t open a public issue for a vulnerability.
What’s most useful
- A request that reaches ALLOW when it should not, or that the model output alone can turn into delivery
- A way to release a BLOCK, or deliver bytes or a destination other than the approved ones
- Request text, quotes or secrets appearing in receipts, logs or anywhere the design says they should not
- Backup or restore overwriting data, or accepting a key that doesn’t match its database
Include the ForgeVigil version, your platform and the smallest steps that reproduce it.
Please don’t
- Test against anyone else’s installation or data
- Run denial-of-service or automated scanning against this website
This website
forgevigil.com is a static site. It has no accounts, forms, cookies or server code, and it does not run ForgeVigil. Its security contact is published at /.well-known/security.txt.