Report vulnerabilities through GitHub private vulnerability reporting. Include reproducible steps using synthetic data and describe the affected revision and impact.

Do not put patient data, credentials, medical records, or exploit details in public issues or discussions. If private reporting is unavailable, contact the repository owner privately before sharing details.

Medora has no supported application release or deployed clinical service yet. Product safety and privacy requirements are documented in AGENTS.md and the product vision.