If you’ve found a security issue in any Charcoal project, please don’t post it publicly (including in Charcoal HQ, our chatroom). Instead, email details of the vulnerability to [email protected], which is a mailing list that will reach the necessary people. They’ll have a look and confirm whether or not it’s a security issue, and deal with it appropriately.

If you’d like to encrypt your email, you can find our PGP key here:


We’d like to extend special thanks to these people, who have helped us out by reporting security vulnerabilities to us.