Security fixes target the latest main branch unless a release branch is explicitly announced.

Use GitHub private vulnerability reporting when it is enabled for this repository. If it is unavailable, open a minimal public issue requesting a private coordination channel. Do not include exploit details, secrets, server names, account names, private paths, or infrastructure information in the public issue.

Reports are especially useful for:

• Secret exposure, credential leakage, or unsafe logging.
• Real hostnames, usernames, ports, key names, key paths, inventory snapshots, or local user paths appearing in public files.
• Output redaction failures or plaintext commands written to audit logs.
• Path traversal or file operations escaping the effective remote workdir.
• Upload sources escaping configured local upload roots.
• Request-review bypasses for upload, mkdir, delete, detached work, power actions, or arbitrary command execution.
• Catastrophic command detection failures.
• Unsafe handling of SSH keys, host keys, server-list backups, preserved reports, or installation rollback.

Valid reports will be acknowledged, reproduced in a minimal environment, and fixed with clear release notes. Never attach private keys, real SSH targets, private server lists, proprietary project data, request files, job logs, inventory snapshots, or private network details to a report.