Please report suspected vulnerabilities privately to laurent@bindschaedler.com. Do not open a public issue until the report has been acknowledged and a disclosure plan has been agreed.

Include the affected platform and scode version, the smallest reproducible command or repository, the observed policy bypass, and its security impact. Avoid including live credentials or unrelated personal data.

Security fixes are supported on the latest released version. The project will acknowledge a complete report as soon as practical, validate it, coordinate a fix and release, and credit reporters who want attribution.