Report suspected vulnerabilities through GitHub private vulnerability reporting or email radheykalra901@gmail.com.

Keep reports private while they are investigated. Use public issues for ordinary bugs and support requests.

Include:

• The BoxBox version, container image tag or digest, and deployment method.
• Reproduction steps, the affected endpoint or operation, and the impact.
• Required access, such as an authenticated account or a public share link.
• A minimal example and sanitized logs when available.

Use disposable files and test accounts. Remove passwords, tokens, private keys, and personal files from the report.

Use the latest stable release when checking whether an issue is still present. If you found an issue on an older version, include that version and whether it also affects the latest release.

Published fixes and affected versions are listed in BoxBox security advisories and the release notes.