Report concerns
privately.
Use the affected component’s private report form. Keep vulnerability details and personal records out of public issues.
Choose the affected component.
Private vulnerability reporting was enabled for each repository when checked through GitHub’s API on 15 October 2026. These forms require GitHub sign-in. The owning repository handles its implementation; the program repository handles program-level concerns.
- Household OS private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- Sovereign Vault private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- Memory Core private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- User MCP private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- Memory Protocol private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- Public AI Skills private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
- Sovereign AI OS private report ↗Enabled · checked 2026-10-15. GitHub sign-in required.
A private fallback.
If a form is unavailable or you are unsure which component is affected, email Jesse with the component and a brief description. Do not include credentials, live personal records, or a detailed exploit in the first message. We can agree on a suitable private channel for further details.
[email protected] ↗Component guidance.
Read the affected component’s current policy before reporting.
This guidance does not authorize testing third-party systems.
Website and collaboration inquiries ↗