Report suspected vulnerabilities to SECURITY_CONTACT.

Do not include secrets, tokens, private keys, private data, proprietary data, or production credentials in a report. Share only the minimum information needed to reproduce or understand the issue.

This template is generic starter material. A project that adopts it must define its own supported versions, security contacts, disclosure expectations, and production response process.

AI-assisted changes must stop and ask before touching secrets, billing, payments, private data, production systems, production admin panels, legal, financial, medical, compliance-sensitive areas, destructive actions, external connectors, automations, auto-merge, or auto-deploy.