Please report a vulnerability in nuclei by email to vertexclique@gmail.com, not in a public issue or pull request.

Say in the report:

• the nuclei version or commit, the platform and the IO backend (io_uring, epoll, kqueue, IOCP);
• what the problem is and what it lets an attacker do;
• how to reproduce it: the smallest program or test that shows it, if you have one.

The report is answered by email, a fix is prepared privately, and the vulnerability is made public once a fixed release is out, crediting the reporter unless they ask not to be named.