Please report suspected vulnerabilities through GitHub's private Security advisories → Report a vulnerability flow. Never put secrets, exploit details, or sensitive receipts in a public Issue.

Before the first release, only current main is supported. Include the affected commit, expected/observed transition, minimal reproduction, and impact.

Missing, stale, duplicate, or contradictory evidence producing ALLOW/PASS is security-relevant. Public hardening ideas may use the security label.