# Support

## Where to ask

| Question | Where |
|---|---|
| A host is classified unexpectedly | open an issue with the four verdict lines and the `report.json` |
| A distribution is missing from the matrix | open an issue with the package names and the changelog line |
| A host broke after remediation | roll back first ([runbook](https://github.com/paulmann/CVE-2026-111497/wiki/10-Operations)), then open an issue |
| A defect in the tool's security logic | private advisory — see [`SECURITY.md`](SECURITY.md) |
| A vulnerability in Brotli itself | the upstream project and the distribution security team |

## What to include

```text
Host:        Debian 12, libbrotli1 1.0.9-2+b6
Command:     bash /root/cve-2026-111497/detect.sh
Exit:        1
Verdict:     VULNERABLE
Consumers:   apache2:3 php-fpm8.2:7
Candidate:   1.0.9-2+deb12u1
Expected:    SAFE, because the candidate changelog names the CVE
```

A report without the exit code and the consumer line cannot be reproduced. Addresses and hostnames
are not needed and must not be included.

## What support is not

- A patching service: the tool decides what the host looks like, the operator decides when to change
  it.
- A fleet scanner: it runs per host by design.
- A source of exploitability judgements for a specific deployment: the threat model states the
  paths, the operator knows the application.