If you find a vulnerability in this tool, report it privately through GitHub Security Advisories rather than opening a public issue.
That covers, for example: a way to make the scanner miss a known indicator, a
path that lets --apply delete rather than quarantine, a command injection
through a crafted filename, or anything that would make running this tool
worse than not running it.
If you are reporting an infection
Section titled “If you are reporting an infection”That is not a vulnerability in this tool and does not need to be private. Open a missed-detection issue, or report the campaign artifacts to opensourcemalware.com, which maintains the primary dossier.
If you are mid-incident
Section titled “If you are mid-incident”Nothing here is a support channel with a response time. Start with order matters and rotate your credentials first.