Security reporting

Report suspected vulnerabilities through GitHub's Report a vulnerability (private vulnerability reporting), when available for this repository. Do not publish credentials, private keys, private models or a vulnerable person's identity. If private reporting is unavailable, open a minimal public issue asking for a confidential reporting channel without exploit details or sensitive data.

Include the affected version, platform, smallest synthetic reproduction, expected trust boundary and observed result. Use generated test identities and synthetic files. This is an initial reference implementation, without an independent security audit or validated anonymity profile. See trust and recovery for its implemented scope and limits.