Report vulnerabilities privately through GitHub private vulnerability reporting. Do not include credentials, private prompts, or exploit details in a public issue.

Include affected version/revision, impact, reproduction steps, and a minimal non-sensitive proof of concept when possible. Maintainers will acknowledge the report through the private advisory and coordinate remediation and disclosure there. No response-time commitment is made until a maintained security team and service level are published.

The tagged release-candidate line and the current v1.0.0-rc.2.3 candidate branch are evaluated during the pre-1.0 period. Users should reproduce reports against the newest available revision when practical. Security or data-loss defects may require compatibility changes.