Report suspected vulnerabilities through GitHub Security Advisories for this repository or by contacting security@sylphx.ai.

Do not open public issues for vulnerabilities, supply-chain weaknesses, native artifact provenance issues, maintainer tokens, publish credentials, private consumer workloads, or unreleased compatibility data. If a secret or package-publish credential is exposed, rotate it first, then document the recovery evidence in the owning runbook or incident record.