The GraalVM team values responsible disclosure from the security research community.

If you believe you have found a security vulnerability in Graal Script Agent, report it to secalert_us@oracle.com, preferably with a proof of concept. Follow Oracle's Reporting Security Vulnerabilities guidance when sensitive material requires encryption.

Do not report suspected vulnerabilities in a public GitHub issue and do not contact individual project contributors directly.

For non-vulnerability questions about sandbox configuration and safe embedding, use the public issue tracker and consult the GraalVM security documentation.