Use Security → Advisories → Report a vulnerability in the GitHub repository to contact the maintainers privately when private reporting is enabled.

If GitHub does not show that option, open an issue asking the maintainers for a private reporting channel. Include no vulnerability details in that request. Do not open a public issue or pull request containing exploitable details.

Include the affected package version or commit, a minimal reproduction, the expected security boundary, and the observed impact. Remove credentials, personal data, and private provider payloads from the report.

Security fixes target the latest release. Keep production adapters and dependencies updated, and follow the documented authorization, durability, and redaction contracts when integrating the kernel.