Use the repository’s private GitHub vulnerability reporting option when available. If it is unavailable, email victor@scalewithsearch.com with a minimal reproduction. Do not include credentials, private transcripts, or customer data in a public issue.

Reports against the current default branch receive review. There is no guaranteed response time or long-term release support.

Validation and correction ledgers can retain response text. Use synthetic inputs for shared examples and protect configured ledgers.

Keep tokens in environment variables or your secret store. Use temporary directories and synthetic data for tests.