Report suspected vulnerabilities privately through GitHub Security Advisories. Do not open public issues containing credentials, authority pointers, private paths, production evidence, exploit detail, or unredacted logs.

Security reports should identify the affected package version or commit, a safe reproduction, impact, and redacted evidence. Source checkouts are development, test, and build inputs only; they must never become production runtime authority.