Do not report credentials, private Slack exports, customer data, or raw production logs in public issues. Remove or rotate sensitive material first.

For a suspected vulnerability, contact the repository maintainers privately with a short description, affected version, reproduction steps, and impact. Do not exploit the issue beyond what is necessary to demonstrate it.

ThreadHarbor deployments should use least-privilege Slack scopes, separate tokens per environment, explicit repository allowlists, and an isolated runtime for any MCP bridge or write-capable adapter.