Please report security problems privately through GitHub's private vulnerability reporting, not in a public issue. Expect a first reply within a week.

In scope: the scripts in this repo (ct/, install/) and what they set up in a container (service user, permissions, options.json changes, handling of the download URL).

Out of scope: Foundry VTT itself (report to Foundry Gaming) and the community-scripts engine (report to community-scripts).

Do not post Foundry download links (Timed URLs), license keys, or Foundry files in issues, pull requests or reports. A Timed URL is a credential for its lifetime.