Report exploitable detection bypasses, resource-exhaustion behavior, signature-verification bypasses, rule-distribution supply-chain attacks, rules whose matches cause information disclosure and other abuse of a rule or bundle through Pipelock Security Advisories. Reports with security impact belong there before public disclosure, including false negatives that enable an exploitable bypass.

Ordinary false positives, non-exploitable detection gaps and rule-quality suggestions can use the public issue templates. If you're unsure whether a report exposes a vulnerability, start with a private advisory.

Include the affected rule ID, bundle and Pipelock versions, a description of the behavior, a synthetic reproduction and a suggested fix if you have one. Public examples must use nonfunctional credentials and fabricated personal or health data. Remove secrets, private addresses and identifying records from configuration excerpts and logs.

The rule checker uses Go's regexp package with RE2 syntax. Report excessive resource use with a bounded reproduction and observed results; catastrophic backtracking isn't the execution model used by this checker.

• Acknowledgment: within 48 hours
• Initial assessment: within 1 week
• Fix and disclosure: coordinated with the reporter, typically within 30 days