Please report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue.

We acknowledge reports within 3 business days and keep you updated until the fix ships. We credit reporters who want credit.

In scope: the RevenueDot server, dashboard, SDK forks, CLI, MCP server and agent skills. For vulnerabilities in the upstream RevenueCat SDK code that our forks share, please also report them to RevenueCat.