Only the latest release of each repository receives security fixes.

Please report vulnerabilities privately — do not open a public issue.

• Preferred: GitHub Private Vulnerability Reporting. Open the repository's Security tab and click Report a vulnerability, or go directly to https://github.com/alloevil/<repo>/security/advisories/new, e.g. https://github.com/alloevil/AgentXRay/security/advisories/new
• Fallback: message @alloevil on GitHub.

Include: affected repository and version, reproduction steps, impact, and any suggested fix.

• Acknowledgement within 3 days.
• Triage and severity assessment within 7 days.
• Fix or mitigation for confirmed issues within 30 days; coordinated public disclosure after the fix ships.

All public repositories under https://github.com/alloevil. Third-party dependencies should be reported upstream.