Report suspected vulnerabilities privately to project maintainers. Do not open a public issue containing exploit details, secrets, personal data, or customer telemetry.
Supported versions and a private reporting address will be published before the first signed release. Until then, this repository is pre-release and must not be treated as a supported production distribution.
See threat model for trust boundaries and secure deployment assumptions.