Meta has a bounty program for the safe disclosure of security bugs. If you believe you have found a security vulnerability in Project Flowerbed, please report it through that program.

Do not file a public GitHub issue for a security vulnerability. Public reports put users at risk before a fix is available.

When reporting, please include:

• a description of the issue and its potential impact
• steps to reproduce, or a proof of concept
• the affected browser, headset, and operating system versions
• any known mitigations

Security fixes are applied to the latest version on the main branch.