Please report vulnerabilities privately through GitHub's Security → Report a vulnerability on this repository, not in a public issue. We acknowledge reports within three working days.

How fctl handles credentials, sandboxes and billing is described in docs/security.md.