OSCD — Incident Report Form

IMPORTANT — PRIVACY NOTICE: This form is PRIVATE and nothing will be published without your explicit consent. Do NOT include passwords, tokens, or private keys in any field.

Third-party processor: This form is delivered through FormSubmit.co (a third-party form-backend service operated by FormSubmit LLC, hosted behind Cloudflare). When you submit, your report is transmitted to and processed by FormSubmit.co, which forwards it to the OSCD coordination inbox. FormSubmit.co acts as a data processor on our behalf. See our Privacy Policy for full details, retention, and your rights.

1. Contact Information

Name or alias * Email *

We will only use this to contact you about your report.

2. Affected Repository (optional)

Only fill this if you are comfortable sharing it.

Repository name Repository URL Package manager

3. Incident Details

Type of attack * Description of the attack * Current status * Estimated impact *

4. Evidence (optional)

Links to suspicious commits, PRs, messages, or screenshots. Do NOT include passwords or tokens.

Evidence links Help requested *

Help identifying the attack vector Help cleaning my code Help reporting to GitHub Security Help communicating to my users Just want to document the case for the community

Urgency level *

5. Consent

* I understand that OSCD is a voluntary community effort, not a professional service * I accept that my case may be documented anonymously for the community * I accept that advice is provided "as is" without warranties

Disclaimer: OSCD is a voluntary community effort of mutual aid. We are not legal advisors, not a professional incident response company, and not a substitute for GitHub Security. All support is provided "AS IS" without warranties of any kind.