Please do not open a public issue.

Report a vulnerability privately through GitHub: open the affected repository's Security tab → Report a vulnerability. If you are unsure which repository it belongs to, use PinBench/pinbench.

Please include what the issue is and roughly how serious you think it is, steps to reproduce, and anything you already know about a fix.

You can expect an acknowledgement within a few days and an honest estimate of the timeline once the report is understood. Please allow reasonable time for a fix before disclosing publicly. We are happy to credit you in the advisory unless you would rather stay anonymous.

The app's SECURITY.md describes what is in scope in more detail.