Report suspected vulnerabilities through GitHub private vulnerability reporting on this repository. Do not put credentials, identity files, private host data, or undisclosed vulnerability details in a public issue.

The public security guide explains the caller trust boundary and residual risks. Test-backed guarantees live only in the security contract, with review procedures in security maintenance.