Security reports are taken seriously. Please report vulnerabilities privately so they can be investigated and fixed before public disclosure.

Use the form0-react-native private vulnerability report. Do not open a public issue for a suspected vulnerability.

Include:

• the affected version and runtime;
• a minimal reproduction or proof of concept;
• the impact you believe is possible;
• any mitigations you have already identified; and
• whether the issue has been disclosed anywhere else.

Reports affecting any version are welcome. When possible, reproduce the issue with the latest release, or the latest default branch for repositories that are not published as packages. Security fixes are normally released for the latest version; older versions are assessed case by case.

Maintainers will review the report, may ask for more information, and will coordinate disclosure after a fix or mitigation is available. Please keep the report private during that process.

For ordinary usage questions, see SUPPORT.md.