Report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue containing exploit details, secrets, or sensitive logs.

The maintained security, trust-boundary, and recovery reference is docs/REFERENCE.md.