RangeSpec is pre-1.0 and should not be the only authorization control for any security test.

Report a suspected vulnerability privately to founder@tropiro.com. Include the affected version, reproducible input, observed result, expected result, and any suggested mitigation. Do not include real customer data, credentials, private keys, or details from an unauthorized target.

The initial response target is five business days. A response target is not a guarantee of a fix date.

Public issues are appropriate for ordinary defects and documentation problems that do not expose a security weakness.