Do not disclose suspected vulnerabilities through public issues. Email security@codevelo.dev with the subject api-contract-audit security report and include affected versions, reproduction steps, and impact.