This project is in beta — an RC has not shipped. There is no private security channel and no response commitment yet. That is a statement of fact, not a policy of ignoring reports.

Report security problems as an ordinary public issue. Until a private channel exists there is no protection we can offer by keeping quiet, and an undisclosed problem helps nobody.

One hard rule, because it is the accident we actually expect: never paste keys, tokens, or .env contents into an issue, a commit, a screenshot or a log. If you already did, rotate the key first and write the report second.