Report it privately through GitHub's private vulnerability reporting. Open the repository the problem is in, choose Security > Report a vulnerability, and describe it there. The report reaches the maintainers only, as a private draft advisory, until a fix is ready. Please do not open a public issue or pull request for a vulnerability that has not been fixed.

If a repository does not show that button, open a private report on probityai/agent-evidence-vectors and name the repository you mean.

Useful reports include the version or commit, the bytes or command that reproduce the problem, and what you expected to happen instead.

• The report is acknowledged within 24 hours.
• A triage verdict (confirmed, not reproducible, or out of scope, with the reasoning) follows within 72 hours.
• If confirmed, a fix timeline is given at triage and updated if it changes.

Every public repository in this organization is covered. A repository that carries its own SECURITY.md follows that file, which lists its scope in detail. A disagreement between a verifier and a conformance case is a normal issue unless it lets a record pass that should fail.