Please do not report suspected vulnerabilities in public issues, discussions, or pull requests. Use GitHub’s Report a vulnerability option on the repository’s Security page to send a private report when that option is available.

If private vulnerability reporting is not enabled, contact the repository maintainer through the private contact method available from the maintainer’s GitHub profile. Do not post exploit details or sensitive data publicly while seeking a private reporting channel.

When possible, include:

• The affected WAC version or commit and your Windows version.
• The component or behavior involved and the potential impact.
• Clear reproduction steps and a minimal proof of concept, if safe to provide.
• Any mitigations you have identified.

Please avoid accessing, changing, or deleting data that is not yours, and do not disrupt services or involve other people’s devices while investigating. Share only the information needed to reproduce and assess the issue.

This policy covers security vulnerabilities in the Windows Asset Creator application and its source repository. Reports involving a dependency are in scope when the issue affects WAC.

The maintainers will review a report and, where practical, coordinate validation, remediation, and disclosure with the reporter. Response and fix timelines are not guaranteed. There is currently no published bug-bounty program.