Security
Responsible vulnerability reporting and the limits of current maintenance.
Private reports
Do not publish exploit details, secrets or third-party data in a regular issue. In GitHub’s Security tab, use “Report a vulnerability” if enabled. Its availability has not been verified or enabled by this website.
If the private channel is absent, open only a security-contact request without describing the vulnerability. No invented email address or promised response time is provided.
What to include privately
Version, build ID, platform, minimal steps, observed impact and a proof of concept without real data. Separate observations from suspicions. Investigate only systems and data you are authorized to test.
Maintenance status
Umbral is experimental. There is not yet a guaranteed patch schedule, supported-version matrix or operational browser update channel. Inheriting Firefox is not enough: integrating and distributing fixes remains the project’s responsibility.