- Please report vulnerabilities privately (open a draft security advisory or contact the maintainer); do not open a public issue with exploit details.
- This is a research codebase maintained on a best-effort basis: there is no SLA and no bug-bounty program.
- Do not commit secrets (API keys, tokens, private keys). CI scans for them.