Report a vulnerability
How to privately report a Pulse vulnerability, exposed secret or suspicious module.
Private reporting
Email heyhubbabubbapr@gmail.com with the subject “Pulse security”. For suspicious modules, include the owner, ID, version, URL and SHA-256 if known. Stop using a module you suspect is malicious.
What to include
Describe the affected component/version, reproduction conditions and expected versus actual behavior. A minimal example and redacted logs help verification. Do not post active secrets or other people’s personal data in a public issue.
Use your own test installation
Reproduce issues in a test environment you own. This page does not authorize testing other people’s servers, password guessing, data extraction, denial of service or changes to their modules. Agree on scope with the operator before testing the public service.
After reporting
The operator reviews reports and may ask for clarification. Unsafe publications can be withdrawn from the catalog; this does not remove copies already downloaded by users. No bounty, around-the-clock response or fixed remediation deadline is promised.