Security reporting covers the current main branch of the public repository only. The private development and evidence repository is not a public support surface.

Security-relevant reports include:

• credential or secret exposure;
• private filesystem path or internal-identifier exposure;
• unsafe executable or archive handling;
• supply-chain or dependency concerns;
• misleading evidence identity; and
• a path that could expose prohibited Gold, Mapping, or Primary Evaluator material.

Do not disclose secrets, private data, or sensitive evidence in a public issue.

Use GitHub's private vulnerability reporting for this repository when available. If that route is unavailable, open a public issue containing no sensitive details and request a private maintainer route; do not include the vulnerability, evidence, identifiers, or reproduction secrets in that issue.

For non-sensitive usage and documentation problems, follow SUPPORT.md.

• No response time is guaranteed.
• This repository makes no security-certification claim.
• Reports do not authorize publication of private evidence or reconstruction of prohibited material.