Report suspected security vulnerabilities in Harbor or the Web Agent API specification privately to harbor-sec@mozilla.org.

Do not open a public GitHub issue for a security vulnerability. Include the affected component or version, steps to reproduce, and the potential impact. Please allow reasonable time for a fix before public disclosure.

For vulnerabilities in other implementations of the specification, contact those implementations’ maintainers.