Security

Report a vulnerability privately. Do not open a public issue.

Use GitHub's private reporting: open the Security tab of this repository and choose Report a vulnerability. Only the maintainers can see the report.

What to report

• A flaw in the specification, such as a way for one caller to read another caller's messages, or to use a grant for an account it was not issued for.
• A bug in the reference server or the examples in this repository.

A bug in a company's own CAP server belongs with that company. Use the contact on its website.

What to expect

• An acknowledgment within three business days.
• A fix or a plan within 30 days for a confirmed issue.
• Credit in the advisory, unless you ask to stay anonymous.

Please give us a reasonable time to fix the issue before you disclose it publicly.