Do not open a public GitHub issue for an active security vulnerability.

Please report security vulnerabilities privately through GitHub private vulnerability reporting on this repository.

Include in your report:

• A clear description of the vulnerability and the affected component.
• Steps to reproduce, including any payloads, configurations, or environment assumptions.
• The potential impact: data exposure, privilege escalation, prompt injection, retrieval poisoning, or other concern.
• Any suggested mitigations or patches if you have them.

Please do not include live credentials, real customer data, or confidential tenant content in a vulnerability report.

This repository is a research proof of concept without a formal release cadence. Treat the latest published branch tip as the maintained version.

The repository owner will acknowledge reports within a reasonable time and communicate a remediation plan or disclosure timeline. Response times may vary.

• Issues in the Azure platform, Microsoft Foundry, or Microsoft Fabric services themselves should be reported to Microsoft through MSRC.
• Vulnerabilities that require physical access to the operator's Azure subscription.
• Issues in third-party dependencies should be reported to the upstream maintainer.

See docs/security.md for the full threat model, authentication boundaries, prompt injection risks, retrieval poisoning considerations, and deployment recommendations.