Use GitHub's Report a vulnerability on this repository when available for a security issue; otherwise open an issue describing the bug with a synthetic reproduction only. Never attach private inventories, source paths, tokens, documents, receipts, keys, or backups.

Supported initial version: 1.x. Preservation, path containment, no-overwrite moves, and cleanup verification are security-sensitive. Include platform, Python version, exact synthetic commands, expected preservation, and observed behavior.