Report suspected vulnerabilities privately to the repository maintainer, sodejm. Use the repository's GitHub Security → Report a vulnerability option if it is enabled. If it is unavailable, request a private contact channel without posting exploit details, credentials, or sensitive repository data in a public issue.

Maintainers review reports against the current default branch and coordinate fixes and disclosure. This repository does not promise a response-time SLA or support window for historical versions.

Keep secrets out of source, fixtures, prompts, logs and generated evidence. Local hooks are opt-in; CI runs with least privilege. External content and agent output remain untrusted. Publishing and hosted mutations require explicit authority.

The shared connector SDK uses fixed destinations, finite budgets, field allowlists and private checkpoints. Checkpoints are not encrypted and can contain sensitive identifiers and continuation tokens; callers own storage ACLs, credential-provider trust, live authorization and retention. See the SDK security and storage boundaries.

See the repository security model and plugin privacy guidance.