This is a public open-source repository.

Do not include live secrets, credentials, private keys, customer information, private user data, or confidential infrastructure details in:

• Issues
• Pull requests
• Commits
• Discussions
• Documentation
• Test fixtures
• Screenshots
• Logs
• Reproduction examples

Use explicit placeholders in every public example.

Do not publish sensitive vulnerability details in a public issue.

Use the repository's private vulnerability reporting mechanism when it is available. This may be exposed through the repository's Security section.

If no private reporting mechanism is available, use a non-public security contact channel published by the project maintainers.

If no private channel can be found, a public issue may request a private contact method, but it must not contain:

• Exploit details
• Live credentials
• Private keys
• Customer or user data
• Sensitive logs
• Reproduction steps that create immediate risk

Do not invent or guess a maintainer's private email address.

A useful private report should include:

• A concise description of the issue
• The affected component
• The expected and actual behavior
• The potential security impact
• Reproduction steps using sanitized data
• The affected version or commit when known
• Suggested mitigations when available

Do not attach live credentials or private user data. Replace sensitive values with clear placeholders.

If a credential may have been exposed:

1. Do not repost the credential.
2. Do not test whether it is active.
3. Revoke or rotate it through the relevant provider.
4. Remove it from the current working tree.
5. Review Git history, artifacts, logs, and caches for additional exposure.
6. Notify maintainers privately.

Deleting a credential from the latest commit does not make it secret again. Rotation or revocation is required.

Security review is especially important for changes involving:

• Authentication and authorization
• Credential storage
• Child process execution
• Shell commands
• File-system access
• Workspace isolation
• Service installation and updates
• Network listeners
• Runtime task dispatch
• Multi-tenant isolation
• Remote event publishing
• AI or agent tool execution
• Logs and telemetry

Changes in these areas should fail closed when authorization, validation, or isolation cannot be established safely.

Please allow maintainers a reasonable opportunity to investigate and prepare a fix before publishing sensitive technical details.

Do not disclose private report contents, affected user information, or live exploit material without coordination with the maintainers.

Use placeholders such as:

<API_KEY>
<ACCESS_TOKEN>
<PRIVATE_KEY_PATH>
<SANITIZED_USER_ID>
https://example.invalid

Do not copy or expose real values.