Do not open a public Issue for an undisclosed vulnerability. Report it through the private security advisory feature or the private contact configured in company/PROFILE.yml. Include impact, reproduction, affected paths, and a safe proof of concept. Never include real credentials or customer data.

Training vulnerabilities must remain isolated to local fixtures, use synthetic data, bind only to localhost, and be clearly labeled. Supported versions are the latest tagged release and the default branch.