Please do not report security vulnerabilities in a public issue.

Use GitHub's private vulnerability reporting for this repository when it is available. Include the affected file or component, reproduction steps, impact, and any suggested mitigation. Do not include secrets or private user data in the report.

If private vulnerability reporting is unavailable, contact the repository maintainers through a private channel before disclosing the issue publicly.

This repository contains protocol documents, adapters, validation scripts, and test fixtures. The protocol is guidance and tooling. It does not by itself secure an application or guarantee that an agent, repository, or deployment is safe.