Report a vulnerability privately to contact@passioncode.ai, never in a public issue. Do not attach credentials, a working exploit or anyone's notes to an issue or a pull request.

What is in scope: the Fabric desktop app and its kernel — the local stack it starts (database, projector, grants and row-level security), the agent sessions it hosts and the provider logins it uses without copying them, the northbound MCP surface, the workspace publisher, and the signed, notarized build. Third-party components are reported to their own projects; tell us too if this repository ships the affected version.