Please report security problems privately, not in a public issue or pull request: Report a vulnerability (GitHub's private vulnerability reporting for this repository).

Include what you found, how to reproduce it and what an attacker could do with it. We aim to acknowledge a report within three working days and to keep you updated until it is fixed. Once a fix is out, we publish an advisory and credit you, unless you would rather not be named.

• The appmarket.org platform: the web app, the API and Git hosting at appmarket.org and staging.appmarket.org, and the code in this repository.
• The appmarket CLI (npm and the release binaries) and the Claude Code plugin.

Apps published on the marketplace belong to their developers and run in their buyers' own Cloudflare accounts; report problems in an app to its developer.

• Access, change or delete other people's data, or keep data you come across.
• Run denial-of-service tests, spam, or automated scans that put load on appmarket.org.
• Use social engineering or physical attacks.

Testing against your own account and repositories, within these limits, is welcome.