Early Light reads hostile input by design: container images from registries, archives and binaries from untrusted builds, and responses from servers we do not control. If you find a way to make it crash, hang, read outside the target, or report a wrong verdict, please tell us.

Report it through DefectDojo's HackerOne disclosure submission program. The process, embargo and safe harbor are the same as for DefectDojo itself: see DefectDojo's security policy.

Please do not open a public issue for a security problem.