Consilium launches coding agents and local verification commands, so security reports are taken seriously.

Please do not disclose a vulnerability in a public issue. Use GitHub's private security advisory flow for this repository. If private reporting is unavailable, open a public issue asking for a private contact channel without including the vulnerability details.

Include, when possible:

• the affected command and version;
• the operating system;
• a minimal reproduction;
• the impact you observed;
• any suggested mitigation.

Do not include real credentials, private source code, or provider session data.

Consilium is currently beta software. Security fixes target the latest release and the default branch. Older releases may not receive backports.