Report vulnerabilities privately through the GitHub security advisory flow for zed-pkg/zed-windsurf.

Do not include access tokens, registry credentials, private repository contents, or personal data in public issues. The extension must never persist zed authentication material or execute package-manager commands through a shell.