Report vulnerabilities in the bundled instructions, validator, tests, examples, or contribution paths that could cause unexpected writes, secret exposure, private-path leakage, destructive actions, permission expansion, unsafe lifecycle transitions, or misleading closeout claims.

Do not include real credentials, customer data, private infrastructure, personal data, proprietary source, or regulated records in a public report.

Use GitHub private vulnerability reporting from the repository's Security tab. Do not open a public issue containing exploit details, secrets, customer data, private paths, or a real production target.

If private reporting is temporarily unavailable, use the repository's security-contact issue template and request a private channel without including vulnerability details. Revoke or rotate an exposed credential before reporting it.

The GitHub release page is the canonical source for the latest supported release.