Please report privately, not in a public issue or pull request. Use GitHub's private vulnerability reporting: open the repository's Security tab and choose "Report a vulnerability".

Useful reports include:

• A way for the bundled scripts (scripts/cli-read.mjs, render-report.mjs, manage-report.mjs or check-report.mjs) to print, save or send data outside their allow-lists, such as secret values, hostnames, names, emails or raw CLI output.
• Instructions in SKILL.md or references/ that could lead an agent to change settings, deploy, contact people or expose sensitive data, contrary to the read-only boundary.
• Generated reports that could include sensitive data despite the redaction rules.

Do not include real credentials, account data or customer information in a report. Synthetic examples are enough.

Fixes are released on the main branch; there are no separately supported versions.

• Vulnerabilities in Vercel's own products, the Vercel CLI or the Vercel plugin. Report those to Vercel through its official security reporting channels.
• Vulnerabilities in a host agent or browser that loads this skill.
• An agent that ignores the skill's instructions. The instructions are guidance, not an access control; account permissions are the real boundary (see README).