Please report security issues privately. Don't open a public issue or pull request for one.

Email founders@brew.new with what you found, the steps to reproduce it, and what someone could do with it. We'll confirm we received it and keep you posted while we fix it.

In scope: the site at growth.engineer, its read-only MCP server at /mcp, the endpoint that counts workflow copies, and the code and build in this repository.

Catalog entries describe other companies' products. A vulnerability in one of those products belongs with that company. If a catalog entry is wrong or points somewhere harmful, open an issue or a pull request here.