Do not report vulnerabilities in public issues. Contact the project maintainers privately with a reproduction, affected version and impact. Avoid including tokens, credentials, production payloads or customer identifiers.

The project runs dependency audit and Semgrep Community in its quality gate. Telemetry and inspector payloads must remain redacted by default.