Please report a security problem privately, not in a public issue.
- Open the repository's Security tab and choose Report a vulnerability. GitHub keeps the report private between you and the maintainers.
- Say what you found, how to reproduce it, and what it could expose. Use made-up data: never paste real candidate or employee details into a report.
- If that button is missing, open an issue that says only "security contact, please" and a maintainer will reach out privately.
You can expect a first reply within seven days.
- A way to make a kit send, post or write to another system without a person approving it first.
- An n8n workflow or webhook that accepts a request without its credential.
- A rendered document that can run a script, load a remote resource or leak data.
- A secret, an API key or personal data committed to a repository.
Screen Scribe, Re-engage Applicants, Talent One and DAG Talent Agents are built in
onepromptman/talentai and published to their standalone repositories. Fix those
kits in talentai and republish each affected edition. Talent Alpha is maintained
in onepromptman/talent-alpha; talentai keeps a labelled copy. Only the latest
version on main is supported.