Security

Report a vulnerability

Last updated November 1, 2026

If you find a vulnerability in misconfig.ai or the misconfig command, tell us and we'll fix it. We read every report.

How to report

Email security@misconfig.ai with:

• what you found and where;
• the steps or files that reproduce it;
• what an attacker could do with it.

Please don't include anyone else's data. A report you made yourself is the best way to show an issue with reports.

What to expect

• We'll reply within 3 business days and keep you updated until it's fixed.
• We'll agree a disclosure date with you. Unless we agree otherwise, please don't publish until it's fixed or 90 days have passed since your report, whichever comes first.
• We'll credit you in the release notes if you'd like. We don't run a paid bounty yet.

In scope

• misconfig.ai, including the browser check, shared reports (/r/), private reports (/p/) and the API under /api/.
• The @misconfig/cli command on npm.
• The checks themselves: a file or folder that makes a check run code, read something it says it doesn't, send something it says it doesn't, or hang; and a crafted file, report or link that makes misconfig show markup or words its checks wouldn't produce.
• Ways a risky setting can hide from the checks. These are welcome too, even when they're not vulnerabilities in the strict sense.

Out of scope

• Denial of service, load testing, or testing the rate limits in a way that slows the service for others.
• Cloudflare's own infrastructure, npm and OSV.dev. Report those to them.
• Social engineering and physical attacks.
• Scanner output, missing headers or best-practice notes without a working attack.

Safe harbor

If you research misconfig in good faith and within this policy, we'll consider it authorized and won't take legal action against you for it. That means you:

• test only with reports and data you created;
• don't access, change or delete anyone else's reports;
• stop and tell us as soon as you reach data that isn't yours, and don't keep it;
• give us a reasonable time to fix an issue before you disclose it.

Useful details

• Contact details in a standard format are at /.well-known/security.txt.
• Shared reports are signed with Ed25519. The public key is at /.well-known/misconfig-keys.json.
• Private reports are encrypted with AES-256-GCM on the computer that made them. The server never receives the key.
• Every check is readable JavaScript: the rules and the code that applies them.