Send suspected vulnerabilities in GitHub Copilot Evals to opensource-security@github.com, GitHub's coordinated-disclosure contact for GitHub-managed repositories. Although that address uses GitHub's opensource-security alias, this project is source available under the GitHub Limited Use Source License, not open-source software (see LICENSE). You do not need repository collaborator access to use this channel.

Do not disclose a suspected vulnerability in a public issue, discussion, pull request, or release comment. Ordinary bugs and feature requests can use the repository's issue tracker.

To help maintainers investigate, include:

• The affected component, release version, tag or commit, and relevant files.
• Your environment and any configuration needed to trigger the problem.
• Reproduction steps or a minimal, non-destructive proof of concept.
• The security impact and any mitigation you have identified.

Plugin and VS Code extension versions can differ; include the artifact name when reporting a released download. Redact tokens, credentials, personal data, and private workspace content before sharing evidence.

Coordinate publication of vulnerability details with the security team and maintainers while they investigate and prepare a fix.

This project is licensed under the GitHub Limited Use Source License (see LICENSE; the VS Code Marketplace extension is governed by its bundled GitHub License Terms for Extensions) and is not open-source software.

Security research and coordinated disclosure follow GitHub's Safe Harbor policy. Consult the current bug bounty scope for program eligibility. This repository does not promise bounty rewards, response deadlines, or a separate long-term support schedule.