Report vulnerabilities privately to support@12ui.com. Do not open a public issue for a suspected vulnerability.

The repository contains instructions, public API schemas, and brand assets. It must never contain API keys, user data, internal service configuration, private corpus data, or implementation source. The publishing workflow copies only an explicit allowlist and rejects private-repository links and symbolic links.