Do not report suspected vulnerabilities in a public issue, discussion, or pull request.

For public releases, use GitHub's Report a vulnerability action in this repository's Security tab. This opens a private vulnerability report visible only to repository maintainers.

GitHub Private Vulnerability Reporting is available only for public repositories. Maintainers must enable it immediately after changing repository visibility to public and before announcing the repository.

Include the affected version or commit, reproduction steps, expected and actual behavior, impact, and any suggested mitigation. Do not include production credentials, API tokens, MCP tokens, media identifiers, chat contents, private URLs, or personal data in the report.

We aim to acknowledge valid reports within five business days and will coordinate a fix and disclosure timeline privately with the reporter.

Security fixes are made on main. Deployments should track the latest compatible commit from that branch until versioned releases are established.