Security fixes are applied to the latest repository release. Skills are guidance, not a security certification; users must review generated implementations for their stack and threat model.

Do not open a public issue for a vulnerability that could put users at risk. Use GitHub's private vulnerability reporting feature when enabled, or contact the maintainer through the private security channel shown on the repository profile. Include affected files/version, impact, reproduction, and suggested mitigation if known. Do not include real credentials or personal data.

Maintainers should acknowledge a complete report within seven days, coordinate validation and remediation, and credit reporters when requested and safe. Publication timing will be coordinated around a fix.

For incorrect legal, provider, or localization guidance without a security impact, use the localization/content issue form instead.