A2VM processes vulnerability data about real infrastructure. Please report security issues in A2VM itself privately, not in public issues: use GitHub's "Report a vulnerability" (private security advisory) on this repository.

Include the affected version (tag), the component (a2vm, via, detect, verdict, client pipeline template) and how to reproduce. We aim to acknowledge reports within 5 working days.

Never include client data, scan results, keys or credentials in a report, an issue or a pull request.