Use GitHub Security Advisories in vparla/GoalRouter to submit a private vulnerability report. Include the affected version, environment, impact, reproduction steps, and any suggested mitigation. Do not include live credentials, access tokens, private source, or other people's data.

Do not open a public issue for an undisclosed vulnerability. Maintainers will acknowledge the report, validate scope, coordinate remediation and disclosure, and credit reporters when requested and appropriate. There is no promise of a particular response deadline.

For safe operating practices, see docs/security.md.