Security fixes are provided for the latest released version of Confluleaks. Older releases may be asked to upgrade before a fix is prepared.

Please do not disclose vulnerabilities, live credentials, internal Confluence URLs, scan reports, or exploit details in a public issue.

Use Report a vulnerability on the repository's Security tab to submit a private report. If private vulnerability reporting is unavailable, open a public issue containing no sensitive details and ask the maintainer to arrange a private communication channel.

Include, where possible:

• the affected Confluleaks version and installation method;
• a description of the impact and affected component;
• sanitized reproduction steps or a minimal proof of concept;
• any known mitigations or suggested fix.

The maintainer will aim to acknowledge a report within seven days and will coordinate disclosure after a fix or mitigation is available. Timelines may vary because this is a volunteer-maintained project.

False positives, missing detection rules, compatibility problems, and feature requests can be reported through the regular issue tracker as long as the report contains no real secrets or private Confluence data.