Do not disclose credentials, private contact details, unpublished reviewer material, or sensitive local paths in a public issue. Use GitHub's private vulnerability-reporting channel if it is enabled; otherwise contact the repository owner through a private GitHub channel before publishing details.

The confirmatory system is research software, not a production autonomous agent or safety-critical control system. Security reports should identify the affected file, version, reproduction steps, and whether frozen artifacts are implicated.