For confidential defects, unsafe harness behavior or accidentally published sensitive material, email jw@osuite.ai with subject Action Effect security report. Include repository/commit, impact and a minimal synthetic reproducer. Do not send live credentials, customer traces or protected cases; ask for a private transfer method first if necessary.

Ordinary non-sensitive synthetic mismatches may be filed as GitHub issues. The harness starts trusted local consumer code; it is not a sandbox for arbitrary untrusted executables. Raw response bytes and a limited stderr preview are written into reports, so use only synthetic data in public runs.

There is no production SLA, guaranteed response time, certification or funded bounty. Sensitive material may be restricted with a safe correction notice; removal cannot recall third-party copies.