Please don't report vulnerabilities in public issues. Use GitHub private vulnerability reporting instead.
Include the affected version or commit, steps to reproduce, and the impact. We aim to reply within 7 days.
Huntsman fetches arbitrary URLs, so issues such as server-side request forgery (reaching private addresses while
HUNTSMAN_ALLOW_PRIVATE=false), auth bypass when HUNTSMAN_TOKEN is set, and container escapes are in scope.