Do not open a public issue for an unpatched vulnerability. Contact the maintainer privately through the security contact published in the GitHub repository. Include affected versions, reproduction steps, impact, and a minimal proof of concept.

A Program Host JSON project is application code, not a passive document. Projects may contain SQL statements, scripts, workflow steps, or external process commands. Only run projects from sources you trust and review executable content first.

Never commit production credentials. Prefer Windows authentication for SQL Server. When credentials are unavoidable, use the application's protected-secret support and keep project files private. Protected values tied to one Windows account are not portable to another account.

Microsoft Access and other local data files can contain sensitive business data. Repository examples must use synthetic data only.