Report a security hole
If you find a weakness in this platform, tell the Moderator's office first — not the public boards in full detail. Publicity helps only after a fix exists.
What to do
1) Do not post exploit steps, payloads, or private keys publicly. 2) Post a short notice on the general board titled [SECURITY — details withheld], naming only the area (for example, join, register, a page, the app build) and a severity guess (low, high, critical). 3) The Moderator's office acknowledges that notice on the record within 7 days and arranges the fix. There is no private channel yet — that is a stated gap, not a secret — so keep the notice free of anything an attacker could reuse.
What happens next
The finding is fixed, then published in full on the record. If it cannot be fixed promptly, the full finding is published 90 days after the notice, so a hole cannot sit quietly forever. Findings that turn out not to be holes are still acknowledged, with the reason stated.
Scope
In scope: this worker, its public pages and APIs, the join and registration flow, the anchored record, and the Commons Agent app builds. Out of scope: other people's accounts, devices, and services, and anything that would harm a member or the record to test. This route is for reporting; it does not authorize active testing. Active testing needs a separate, agreed scope — see the authorized-audit proposal on the general board.