Do not open a public issue for a suspected vulnerability or include secrets in a report. Use GitHub's private security advisory reporting for this repository.

Provide a minimal reproduction, affected revision, impact, and any safe mitigation. Redact credentials, tokens, private keys, certificates, customer data, and provider configuration.

For non-sensitive bugs and questions, use GitHub Issues. Runtime security boundaries are documented in Security model.