Please report security problems in @dune/plugin-admin privately, not through a public issue, pull request, discussion or branch.

Use GitHub's private reporting: open this repository's Security tab and choose Report a vulnerability. That opens a confidential advisory that only you and the maintainers can see.

Include what you can of:

• the affected version and how you run it (for Dune itself, dune --version),
• what the problem is and what an attacker could do with it,
• steps or a minimal example that reproduce it.

You don't need a complete write-up or a fix; a clear description is enough to start.

We read every report, confirm whether it is a vulnerability, and work on a fix privately. Details are kept out of public commits, branches and the CHANGELOG until a fixed release is available. When it ships, the release notes describe the problem without a step-by-step recipe, and we credit the reporter if they want that.

Security fixes go into the latest release of @dune/plugin-admin; older versions are not patched, so upgrade to the newest version first.

Ordinary bugs, hardening ideas that have no exploit, and questions belong in the regular issue tracker.