Do not report vulnerabilities in listed third-party plugins through this repository. Use the plugin's repository.issues URL or the publisher's private security channel.

Report problems in the catalog schema, builder, deployment workflow, or a malicious catalog entry through GitHub private vulnerability reporting for this repository. Do not include secrets in a public issue.

Catalog inclusion is not a security audit. OpenHarness must show the declared permissions and require an explicit user action before installation.