Security Report Intake

Report a vulnerability.

Use this form for structured intake. For sensitive proof, submit a non-sensitive summary first and Forge will coordinate encrypted follow-up.

Do not include customer data, classified material, export-controlled material, credentials, or destructive proof in this form. Encrypt sensitive follow-up material with Forge's PGP public key after triage begins.

Alternative Channel

If email is required for encrypted coordination, use [email protected] with the published PGP public key.

Policy

Testing must remain non-destructive and within the responsible disclosure policy.