# Security Policy ## Reporting a Vulnerability Draft a [new security advisory](https://github.com/FreshRSS/FreshRSS/security/advisories) online, or report security issues to ([PGP public key if relevant](https://alexandre.alapetite.fr/cv/pgp.asc)). ## AI-assisted security scanning Include: * Which AI tool was used * Whether you are yourself a user of FreshRSS Recommendations: * Check duplicates in existing public PRs, issues, discussions, documentation * Consider submitting a public PR if the vulnerability was mostly found by a public AI Inspiration from : > AI detected bugs are pretty much by definition not secret, and > treating them on some private list is a waste of time for everybody > involved - and only makes that duplication worse because the reporters > can't even see each other's reports.