Please report suspected vulnerabilities privately through GitHub private vulnerability reporting. Do not post exploit details, credentials, or personal data in public issues.

Include the affected version/commit, deployment type, prerequisites, impact, and minimal reproduction steps. Use test accounts and redact secrets. Describe any evidence shared elsewhere. Avoid testing against other people's accounts or production data without authorization.

Maintainers acknowledge private reports within 5 business days. Only the latest released version receives security fixes. Include your installed version when reporting so maintainers can assess applicability. Resolution timing depends on the report and the remediation required.

See the security architecture and operator guidance and implemented controls (docs/SECURITY_REMEDIATION_W1_W4.md). Architecture descriptions are not a guarantee about a particular hosted deployment.