Reporting a vulnerability

If you find a vulnerability in this tool, report it privately through GitHub Security Advisories rather than opening a public issue.

That covers, for example: a way to make the scanner miss a known indicator, a path that lets --apply delete rather than quarantine, a command injection through a crafted filename, or anything that would make running this tool worse than not running it.

If you are reporting an infection

That is not a vulnerability in this tool and does not need to be private. Open a missed-detection issue, or report the campaign artifacts to opensourcemalware.com, which maintains the primary dossier.

If you are mid-incident

Nothing here is a support channel with a response time. Start with order matters and rotate your credentials first.