Please do not disclose a suspected vulnerability in a public GitHub issue, pull request, Trellis task, journal, or commit. Use GitHub's private vulnerability reporting or Security Advisories for yanbo92/topicconsole. If the private reporting form is unavailable, contact the maintainers privately through GitHub before sharing technical details.

Do not include live credentials or other secrets in a report. Redact them and describe how they can be revoked or rotated instead.

When safe to do so, include:

• the affected release, commit, or build;
• the operating system and relevant configuration (without secrets);
• concise reproduction steps or a minimal proof of concept;
• the security impact and any known exploitation conditions; and
• redacted logs or screenshots that help confirm the issue.

TopicConsole can store broker URLs, bearer tokens, and related connection data in .topicconsole.json. The file is plaintext and must never be committed, attached to a public issue, or shared in an unredacted support bundle. If it may have been exposed, revoke the affected broker tokens and replace them before investigating further.

SSH passwords, passphrases, private keys, TLS private-key material, and usable internal endpoints must stay out of the repository and out of public logs.

The maintainers will acknowledge a private report, validate the impact, and coordinate a fix and disclosure timeline with the reporter when appropriate. Please allow time for that coordination before making vulnerability details public. There is no guaranteed response or remediation time.

Non-security bugs and ordinary feature requests can be reported through the normal public issue process after removing sensitive information.