Do not publish an unresolved vulnerability, private key, exploit transaction, or reproducible attack path in a public issue.

Use GitHub private vulnerability reporting from the repository Security tab when available. Otherwise contact the repository maintainer through the linked GitHub profile before sharing sensitive reproduction details.

The full policy, supported package line, trust boundaries, current limitations, and incident-response process are documented in docs/SECURITY.md.