Replace this placeholder with a real private vulnerability reporting channel before public release.

Do not disclose secrets, local private paths, prompt-injection payloads, or real project data in public issues.

Default posture: read-only first, smallest MCP surface, deterministic checks over agent self-reporting.