Instruction: # Eligible Vulnerabilities
* Design flaws which could be exploited
* Insecure default config/settings
* Usage of insecure (deprecated) algorithms
* Poor/incorrect usage of a package/dependency resulting in a vulnerability
# Exclusions
While researching, we'd like to ask you to refrain from:
* Denial of service
* Spamming
* Social engineering (including phishing) of passhash staff or contractors
* Any physical attempts against passhash property or data centers
* Vulnerabilities with source code host/provider (e.g. github)
* Vulnerabilities where the root cause is upstream (e.g. a dependency with a vulnerability)
