Report suspected security weaknesses or exposed private information through an appropriate private channel.

You do not need to prove that a weakness can be exploited before reporting what you noticed.

Do not post vulnerability details, passwords, access tokens, student records, or other sensitive information in an issue, discussion, pull request, commit, or public comment.

1. Report Privately
2. What to Report
3. Helpful Details
4. If a Credential Is Exposed
5. Testing Boundaries
6. Report Handling and Supported Versions
7. Status

Use the option that is available to you:

• GitHub private reporting: In the affected repository's Security or Security and quality area, select Report a vulnerability, if available.
• Students: Contact your instructor through the private communication method listed in Brightspace.
• SNHU technology or information exposure: Use the SNHU Technology Help Desk and applicable institutional incident-reporting procedures. SNHU sign-in is required.
• Other reporters: Use the approved private security contact listed in the affected repository's README.

If no private contact is listed, ask maintainers how to contact them privately without including vulnerability details.

GitHub's private reporting feature is not available in every repository. Do not substitute a public report containing sensitive details.

Examples include:

• Exposed passwords, access tokens, keys, or student information
• Scripts, dependencies, or workflows that could allow unintended access, commands, or data disclosure
• Instructions that could expose private information
• Unauthorized access to protected repository resources
• Assessment weaknesses that could expose restricted answers or enable academic misconduct

For ordinary installation problems, broken links, or suggested improvements, use Support.

If you are unsure whether a concern involves security or privacy, describe it through a private channel first.

Include what you know:

• The affected repository, file, workflow, or version
• What you noticed and why it concerns you
• When you noticed it
• Safe steps that explain the problem, if already known
• Whether the information has been shared elsewhere

Identify the location of exposed information without copying the secret or private record into the report.

A demonstration is optional. Use invented, non-sensitive data and remain within any testing authorization you already have.

Do not use or test another person's credential.

If an exposed password, token, or key belongs to you, invalidate it promptly using the issuing service's process. Replace it if needed, and report the exposure privately.

Deleting the visible text alone is not sufficient. Copies may remain in repository history, logs, or other locations.

If you encounter someone else's private information, stop accessing it and report its location. Do not download, redistribute, or investigate additional records.

This document does not authorize security testing.

Follow the explicit scope of any authorized course activity or testing agreement. Do not access other people's data, test exposed credentials, bypass access controls, scan systems without permission, introduce malware, or disrupt services.

Maintainers prioritize the repository's default branch and releases identified as current by that repository. Older versions and student or personal copies may require separate corrections.

Report exposed information regardless of version. Also report weaknesses in a copy when they appear to originate in shared repository materials.

Maintainers will make a reasonable effort to assess reports, coordinate with the responsible institutional or service personnel, and communicate an outcome when practical.

Response times depend on the concern and the responsible support process. This document does not guarantee a response deadline or offer a vulnerability reward.

Coordinate with maintainers before publishing technical vulnerability details. Do not publish credentials, private records, student information, or restricted assessment content.

This guidance is provisional while institutional review is pending. It does not authorize testing or replace SNHU incident-reporting requirements, course instructions, or applicable platform terms.