Report suspected vulnerabilities through a private security advisory on GitHub. Do not disclose vulnerability details, credentials, provider tokens, document contents, or personal data in a public issue.

Framework security ownership, including optional AI and Collaboration boundaries, is documented in Framework Security Boundaries.

This repository does not promise support through public issues or pull requests. A private report should include the affected package/version, reproduction conditions, impact, and a safe contact method. Package publication and deployment remain separate release-authority decisions.