The 4th Wave AI feed repository is public, but not every security finding should be discussed publicly.

Do not open a public issue for findings involving:

• credentials, tokens, secrets, or exposed environment variables;
• workflow permission escalation;
• untrusted pull-request code obtaining write access;
• dependency or action compromise;
• arbitrary file writes or branch manipulation;
• injection into generated RSS, Atom, JSON, HTML, or Markdown;
• unsafe cross-domain collection behavior;
• access to private infrastructure or unpublished data;
• bypass of branch protection, approval, or publication controls.

Use GitHub’s private vulnerability-reporting feature when it is enabled for this repository. When that feature is unavailable, contact the repository owner through a previously verified private channel and provide only enough information to establish the issue safely.

Do not include working credentials, private infrastructure addresses, personal information, or destructive proof-of-concept payloads.

A useful security report should contain:

• affected repository path, workflow, action, or dependency;
• affected branch or commit SHA;
• exact preconditions;
• reproducible steps using harmless test data;
• expected behavior;
• observed behavior;
• potential consequence;
• suggested containment;
• the observation that would disprove the finding.

• main must not be edited directly for repair batches.
• Workflows that write generated files should use the minimum required permissions.
• Third-party actions should be pinned deliberately and reviewed before upgrades.
• Untrusted pull-request code must not receive repository secrets or write authority.
• Generated HTML and feed content must be escaped or sanitized appropriately.
• External links collected from trusted hubs require explicit domain and path controls.
• Repository credentials must never be embedded in source files, logs, artifacts, or generated reports.
• Live tests that create generated-file churn belong on disposable branches.
• Security fixes require a rollback path and explicit human approval before production merge.

The actively maintained default branch and open repair pull requests are the primary supported states. Historical branches and generated archives may be preserved as evidence but should not be assumed to contain current security fixes.

Receipt, severity, and remediation timing depend on the evidence and potential impact. A report is not treated as confirmed until the affected behavior is reproduced or otherwise supported by sufficient evidence.

Public disclosure should occur only after containment and with explicit approval.