If you want to report a vulnerability, please do not use the issue tracker or pull request, but instead contact security@domjudge.org so we can assess the issue and publish a fix when making it public.

Please mention the affected DOMjudge version and details of the vulnerability and how to reproduce it. We promise to publicly disclose the reported vulnerability, with the appropriate credit if desired, when we've agreed on a proper way to solve it. We try to keep you updated at least once a month in case of more complex vulnerabilities.