Report vulnerabilities privately through GitHub's Report a vulnerability. Don't post exploit details in a public issue.

Include the skillshare version (skillshare version), your OS, what you found, steps to reproduce it, and the impact. A small proof of concept helps. Remove tokens, secrets and personal data from logs and configs.

Only the latest release is supported.

For how skillshare scans skills before installing them, see the audit engine. For token and network rules of skillshare mcp serve, see Serve skills over MCP.