Report suspected vulnerabilities through GitHub private vulnerability reporting, not a public issue. Include the affected package versions, impact, and redacted reproduction steps. Security fixes target the latest published package set. Do not include biometric state, machine data, hardware identifiers, or other sensitive artifacts in an issue or test fixture.

Every privileged component and every open socket requires an explicit threat model and justification. Components that cannot meet that bar do not ship.