Do not open a GitHub Issue with a proof of concept, exploit steps, or a zero-day. Do not paste live Stripe keys, Polar tokens, database URLs, webhook secrets, or customer billing details into Issues, pull requests, or Polar messages.

Report privately by email to hello@yellowgram.dev with subject HookSteel security. Prefer a short description and a redacted repro. Do not attach live secrets.

If this repository enables GitHub private vulnerability reporting, you may also use:

https://github.com/yellowgram/hooksteel/security/advisories/new

If that page says reporting is turned off, email hello@yellowgram.dev instead. Do not open a public Issue that contains exploit detail.

SUPPORT.md is best-effort GitHub Issues for kit questions within the purchase window. That path is not a penetration-test retainer and not permission to post exploit details while a private report is pending.

Production correctness of your outbox and adapters is yours. The public license is PolyForm Noncommercial 1.0.0 (source-available; OSI-approved license = false) and has no warranty. Commercial production use is the HookSteel commercial grant in docs/COMMERCIAL_GRANT.md. Legal seller: Suthirth Solutions, operating as yellowgram. Contact: hello@yellowgram.dev. This policy does not add a hosted gateway, auto-fix, or a warranty that a side effect is correct.