Do not use an issue, discussion, or pull request for a suspected vulnerability, exposed credential, or private-data leak. Use GitHub's private vulnerability reporting for this repository so the report remains visible only to the owner and authorized maintainers.

Include the affected revision, reproduction steps, impact, and any suggested mitigation. Do not include real user prompts, credentials, or restricted dataset records in the report.

The project is pre-alpha. Security fixes apply to the latest commit on the default branch unless a release policy is published later.