# Security policy ## Report a vulnerability privately Please **do not** report suspected vulnerabilities through public GitHub issues, discussions, pull requests, or social media. Email [security@wenet-ec.com](mailto:security@wenet-ec.com) with: - a description of the issue and affected component/version; - steps to reproduce or a proof of concept; - impact assessment and any mitigations you have identified; and - a secure contact method for follow-up. We aim to acknowledge a report within 72 hours, validate the issue, coordinate a fix and disclosure timeline, and credit reporters when they want credit. ## Scope Reports are welcome for Edge Admin, Edge Agent, Nexmaker, deployment assets, and documentation or configuration that creates a security risk. For VPN implementation behavior, include the relevant Netmaker or netclient version so we can determine whether the issue belongs upstream or in Edge Core's integration. Please avoid accessing data that is not yours, disrupting services, or using social engineering while researching a report.