Report vulnerabilities privately through the security contact at https://colomboai.com/security. Do not include live tokens, private manifests, or customer evidence in a public issue.