All AuthZed products operate under a security embargo program. This means that vulnerabilities are privately reported, analyzed for applicability, notice is given, and a resolution is created and distributed. The issue is only made public once those affected in the embargo program have enough time to address the issue or have accepted the risks.

If you discover a vulnerability, avoid posting it publicly. Please report it by sending an email to security@authzed.com. For more details on how to report, see https://authzed.com/docs/authzed/concepts/security-embargo