Please report security-sensitive issues privately to the maintainer rather than opening a public issue.

Security reports should concern repository-owned code, automation, rendering or validation logic, workflows, or documentation that could materially mislead users about a security boundary.

Do not include credentials, private data, or exploit details in public issues or pull requests. External runtimes, renderers, publisher targets, and source material retain their own security and trust boundaries.

Passing repository checks is evidence only for the tested revision and declared scope; it is not a general security certification.