Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not post exploit details, signing keys, production grants, live databases, authorization headers or customer payloads in public issues.

Include a minimal synthetic reproduction, affected version, operating system, trust boundary and expected versus actual behavior. Stop affected dispatch or admission if credentials or ledgers are exposed, and reconcile external effects before restarting.

Version 0.2 is the current public implementation. It is not independently audited or certified. There is no promised patch-response time or paid SLA. Review the operations and verification notes before consequential deployment. Dependencies retain their own security/support lifecycles.