Please report security-sensitive issues privately to the maintainer rather than opening a public issue.

Security reports should concern repository-owned code, automation, parsers, converters, validation logic, workflows, or documentation that could materially mislead users about a security boundary.

Do not include credentials, private data, or exploit details in public issues or pull requests. External tools, source material, and optional dependencies retain their own security and trust boundaries.

Passing repository checks is evidence only for the tested revision and declared scope; it is not a general security certification.