Use GitHub private vulnerability reporting for the HouseQuest Core repository. Do not open a public issue for a suspected vulnerability. Include the affected version, a minimal synthetic reproduction, impact, and any proposed mitigation.

Never attach or paste household captures, uploaded media, SQLite databases or WAL files, logs, prompts, transcripts, model payloads, tokens, PINs, service configuration, or other private household data. Replace all examples with synthetic fixtures before reporting.

If private vulnerability reporting is not available on the repository, contact the repository owner privately and provide only enough metadata to arrange a secure disclosure channel.

HouseQuest Core is intended for loopback use by default or direct HTTP on a separately trusted private LAN. It is not hardened for public-Internet exposure or reverse-proxy hosting. OMP may transmit selected workflow inputs to the configured model provider; see the privacy boundary in README.md.