This is the default policy for repositories under @calvinchengx that do not ship their own. A repository's own SECURITY.md always takes precedence, and the emulators each have one with scope specific to what they enforce.

Report privately through GitHub, on the repository concerned: Security → Report a vulnerability. That opens a draft advisory visible only to you and the maintainer.

Please do not open a public issue for a security report, and please give the project a chance to ship a fix before disclosing.

Include what you would want if you were fixing it:

• the affected component and version, or the commit you tested;
• how to reproduce, ideally as a failing test or a single command;
• what an attacker gains, and from what starting position.

Expect an acknowledgement within a few days. These are personal open-source projects, not a staffed security team, so please be patient with timelines.

Most of what lives here is a local development tool that is deliberately insecure: seeded identities and published secrets, unauthenticated admin surfaces, self-signed TLS, no encryption at rest. Those are design, described in each project's docs, and are not findings.

What is worth reporting is where a tool betrays the developer running it, or teaches their code something false:

• escape from the emulator to the host;
• real cloud credentials leaking into a log, an error body, or a fixture;
• authorization or token validation that is wrong where it is enforced, rather than absent by design, because consumers test their own security code against it;
• being more permissive than the service being emulated, which certifies code that will fail in production;
• supply chain: a compromised dependency, or a release pipeline that could ship a binary we did not build.

Each repository's own policy is more specific. If you are unsure which side a report falls on, send it. A misfiled report costs little; a silent one costs more.

Fixes land on main and ship in the next release. There are no long-lived maintenance branches, so please confirm against main before reporting.