Use the latest npm release published by the protected workflow. v0.1.0 is an unsafe preview and is unsupported for production.

Use this repository's private vulnerability reporting. Include the version, impact, reproduction steps and minimal sanitized evidence. Do not publish exploit details, credentials, financial data or tenant identifiers.

Maintainers coordinate fixes and disclosure privately and publish an advisory when users need to act.