Do not disclose a suspected vulnerability in a public issue.

Email security@emqx.io, the public reporting channel used by EMQX. Include the affected Provider version or commit, impact, reproduction steps, and any suggested mitigation. Test only against systems and data you own or are explicitly authorized to use.

This statement does not establish a response-time or remediation-time commitment.