Report vulnerabilities privately through GitHub security advisories. Do not include credentials, private source, Codex transcripts containing sensitive data, or weaponized payloads in a public issue. The benchmark executes model-written C only inside its local evaluator boundary; review isolation before adapting it to untrusted services.