We welcome security reports.

We currently support all releases of Reach.

If you find a vulnerability, please use your discretion.
Reach is not a networked tool and is written in a (relatively) safe language. We would be surprised if their were vulnerabilities and use cases for production use warranting private disclosure, but it's up to you.

Private contact is the contact in the CODE_OF_CONDUCT.

Reach can be used to find security vulnerabilities. If you do so, a citation would be appreciated.