Do not open a public issue or pull request for a security vulnerability. Use either confidential contact:

• Email: security@soulfiremc.com.
• Discord: send a private message to pistonmaster through the SoulFire community.

Name the affected repository, version, and component. Include reproduction steps or a minimal proof of concept, expected behavior, actual behavior, and potential impact. Describe any required permissions, configuration, or network access. For client/server problems, include both versions. For SDK problems, include the package and runtime versions. For packaging problems, include the package source, platform, and architecture. Remove tokens, passwords, account data, proxy credentials, and bypass keys from logs and examples. Use an isolated environment and systems that you own or have permission to test.

Include the exact affected version, even if it is an older release or development build. Repositories can provide their own version policy. These shared guidelines do not establish a fixed support period or backport schedule. Keep exploit details private while maintainers investigate. Coordinate publication with maintainers so users can receive a fix or mitigation first. Response and release timing depend on the report. This policy does not promise a response deadline.

For ordinary bugs and questions, use the support directory.