Report a Uleravo vulnerability privately.

Email s.aloufi01@gmail.com with the affected version or URL, impact, and minimal synthetic reproduction. The published policy aims to acknowledge a complete report within five business days; this is not an SLA.

Do not send live credentials, customer data, or unnecessary source. The machine-readable contact policy remains available at security.txt.

Test only systems and data you own or are authorized to assess. Avoid denial of service, social engineering, persistence, privacy violations, and destructive testing. Stop if you encounter data that is not yours. Allow reasonable time for investigation and remediation.

Reports can contain sensitive paths and redacted evidence. A complete scan describes accepted inputs within its analyzer scope; it does not certify that a repository is secure. This public site is not an agent execution or enforcement boundary.