Email security@repl.it with a description of the issue, its potential impact, and steps to reproduce. Please do not open a public GitHub issue.

• Acknowledgment within 7 business days
• Initial assessment within 14 business days
• Remediation is performed based on severity

We follow coordinated disclosure: we investigate, ship a fix, then disclose publicly — crediting the reporter unless they prefer anonymity. Please allow reasonable time to remediate before any public disclosure.

Questions: security@repl.it