Use GitHub private vulnerability reporting. Do not post exploit details or private content in a public issue.

Include the affected release, prerequisites, minimal reproduction with synthetic data, which protection fails, and the actual result. Never include passwords, agent tokens, or a real site's database.

The latest 0.5 patch is the supported version. This project is early and has not had an independent security audit. Fixes are released with a changelog. Use HTTPS, scoped short-lived tokens, protected storage, and tested backups.