Email signal@humanjudgment.org with subject JEP security report: <summary>. Use this route for security-sensitive findings in JEP repositories; do not post exploit details or secrets in public issues or pull requests.

Include the affected repository and version or commit, a minimal reproduction using synthetic data, expected and observed behavior, and impact. Identify the protocol profile or historical mode if relevant. Never send production private keys, credentials or unnecessary personal data.

The current maintained releases are the review target. The maintainer and reporter can coordinate validation, remediation and disclosure; no response-time or bounty commitment is implied. This email route does not require GitHub private vulnerability reporting to be enabled.