This action handles a DefectDojo API key and uploads scan reports. If you find a way to make it leak the key, send data anywhere other than the configured DefectDojo instance, or run code it shouldn't, please tell us.

Report it through DefectDojo's HackerOne disclosure submission program. The process, embargo and safe harbor are the same as for DefectDojo itself: see DefectDojo's security policy.

Please do not open a public issue for a security problem.