Report a vulnerability in a Petiole repository, the Petiole API or the platform privately:

• with GitHub's Report a vulnerability on the repository's Security tab, or
• by email to support@petioleapp.com, with "Security" in the subject.

Please include what is affected, how to reproduce it, and what an attacker could do. We answer within three working days, keep you informed while we fix it, and credit you if you wish once it is fixed. Do not test against another organisation's data, and do not disclose the issue publicly before it is fixed.

If you exposed an API key, revoke it at once on Keys & access in the platform app and make another: a revoked key is refused within a minute.