Found a problem?
Share the affected URL, reproduction steps, and observed impact with the maintainer.
Private reporting
Open a private security report on GitHub →
Identify whether the issue concerns the NoHalu website or the halu-core engine. If GitHub reporting is unavailable, contact the maintainer through Feedback to arrange a private channel before sending sensitive details.
Current scope
The public publication serves articles and resource downloads. Hosted challenge execution and API-backed catalogs are paused. Descriptions of the earlier token and scoring system belong to that experiment.
Resources are documentation
Templates and personas do not enforce access controls. Source references and risk notes describe the evidence available for an entry; they are not a blanket security approval.
Website configuration
The website configures Content Security Policy, frame restrictions, and other response headers. Their presence is a defense measure, not proof that every vulnerability is prevented. Report unexpected behavior with the URL and response details.