If GitHub private vulnerability reporting is enabled for this repository, use the repository Security tab to submit the report privately.

If private vulnerability reporting is not enabled, contact the maintainers privately to coordinate disclosure. Do not open a public issue with exploit details, credentials, tokens, database contents, or other sensitive material.

Include:

• affected lwc version or commit
• environment details
• reproduction steps
• impact summary
• any mitigations or workarounds you have confirmed

Please wait for a coordinated response before publishing full details.

• SQLite documents, provenance, frozen revisions, and explicit relation facts remain authoritative. Grafeo and embedded SurrealDB stores are disposable sidecar projections and must never be the only copy of knowledge.
• Existing config, runtime, or sidecar symlinks are rejected. Projection errors are sanitized and must not disclose storage paths, environment values, document text, or credentials.
• A document mutation may commit before its rebuildable projection Work. Graph reads fail closed when the selected sidecar is unavailable. Do not edit engine sidecars or Work queue files manually.
• Search and graph reads are local and unrecorded by default. Semantic relation reasons are durable content, so do not place secrets, credentials, sensitive prompts, or raw chain-of-thought in them.
• Cargo packages explicitly exclude .agent/, .local-benchmarks/, and .pi-subagents/; plan notes, real-corpus stores, prompts, transcripts, and review artifacts must never enter release archives.