Security
By Amir Chaudhry - 2026-11-03
It's important to consider the process of disclosing issues to us. Many bugs can be reported as usual on our issue tracker, but public forums are sometimes inappropriate for reporting security issues.
If you think you've discovered a security vulnerability, the best way to inform us is to send us an email to security [at] mirage.io. One of the team will respond and we will take it from there.
Please note that we track security issues via the OCaml Security team. You can find advisories at osv.dev (or in the OCaml advisories repository).
We published earlier advisories ourselves here (they have been incooperated into the OCaml security advisories):