GitHub Private vulnerability reporting is enabled for this repository, verified October 23, 2026. No email reporting address is published.
Sign in to GitHub and use Report a vulnerability. You can also open the repository's Security advisories page and select Report a vulnerability. An unauthenticated visit redirects to GitHub sign-in and preserves the private-report destination.
The initial report is shared privately with repository maintainers through GitHub. Do not put vulnerability details in a public issue. If the form is temporarily unavailable, wait for the private channel rather than posting the details publicly.
A useful private report identifies the affected commit, harness/tool capabilities, expected and observed behavior, impact and minimal synthetic reproduction. Omit real relationship data and credentials. Distinguish an issue in the skill or bundled development tools from a host/provider issue.
This project currently maintains the latest main-branch content; there is no separate supported-version or response-time commitment. Findings will be assessed on their evidence and impact.