Security Report
Frame Localizer Security Policy
Last updated: March 18, 2026
1. Reporting
Security issues should be reported privately through the designated reporting channel.
Please do not disclose vulnerabilities publicly before they are resolved.
2. Scope
The following areas are in scope for responsible disclosure.
- the Frame Localizer plugin
- the hosted backend service
- service-related data handling
3. Out of Scope
The following are not considered in scope for this policy.
- third-party services not operated by Frame Localizer
- external platform vulnerabilities
4. Handling Process
Reported issues are reviewed, prioritized, and addressed based on severity and impact.
We may coordinate disclosure after a fix has been deployed.
5. Submission Guidance
Private reports should include enough context for review.
For now, direct reports and follow-up questions to nowonly0816@gmail.com.
- description of the issue
- reproduction steps
- impact assessment
- additional details or proof of concept when available
Private report
Submit a security report
Reports from this form go only to the private security review queue.