# Use GitHub for product questions and private security reports.

GhostGet is maintained in public by the [Hraness GitHub organization](https://github.com/hraness). It has two contact channels: public GitHub issues and GitHub private vulnerability reporting. There is no phone number, postal address, or support inbox.

These channels match the repository’s security policy for GhostGet v0.19.0.

## Public product questions

Open a public issue on [github.com/hraness/ghostget/issues](https://github.com/hraness/ghostget/issues) for defects, documentation gaps, or questions that do not include secrets. Do not paste credentials, authenticated traffic, private content, browser profiles, state directories, or provider account identifiers into a public issue.

## Unofficial channels

Unofficial mirrors, social replies, and guessed email addresses aren’t maintainer contact channels. If a report includes secrets, use private vulnerability reporting.

## Security reports

Report suspected vulnerabilities through [GitHub private vulnerability reporting](https://github.com/hraness/ghostget/security/advisories/new) for the GhostGet repository. That is the path named by the public security policy. Do not open a public issue containing credentials, cookies, tokens, private content, or local paths.

The [security guide](https://ghostget.com/docs/explanation/security-model/) explains how GhostGet stores sign-ins and what happens when a service changes. Read it before you connect an account. Source-side policy lives in the repository `SECURITY.md` for v0.19.0.

## Read before you file

Confirm current behavior in the [getting started guide](https://ghostget.com/docs/tutorials/getting-started/) and [llms.txt](https://ghostget.com/llms.txt) before opening an issue.