The detailed security boundary and disclosure guidance is maintained in SECURITY.adoc. Please report suspected vulnerabilities privately through GitHub Security Advisories; do not post exploit details or private data in public issues.