Do not report suspected vulnerabilities in a public issue. Use the repository security advisory workflow.

Converge treats repositories, manifests, tool output, and dependency metadata as untrusted input. Network access and mutation are explicit, and secrets must not be persisted.