Report suspected vulnerabilities privately through GitHub private vulnerability reporting. Choose Report a vulnerability rather than opening a public issue with exploit details or credentials.

Include the affected version or commit, deployment configuration with secrets removed, impact, and the smallest reproducible example. Do not include live passwords, provider tokens, personal data, or unredacted logs. Coordinate public disclosure with the maintainers after they have assessed the report.

MoonMind is self-hosted and intended for one operator per instance. Keep the default loopback binding for local use. Before exposing it to another machine, configure authentication and ingress controls as described in Authentication Contracts.

Container isolation is not a blanket security guarantee. Restricted network access needs an enforced configuration; see Restricted Egress. Review Secrets System for credential handling and the limits of opt-in outbound scanning.