Security fixes are provided for the latest released minor version.

Use GitHub's private vulnerability reporting feature for this repository. Include the affected version, a minimal reproduction, the impact, and any mitigation you have tested.

Do not include credentials, private MCP responses, or sensitive evidence in a public issue.

The runtime security boundary is documented in docs/SECURITY.md.