Do not report vulnerabilities through a public issue in this mirror.

Use the Hive security policy and its private vulnerability-reporting channel. Hive is the canonical source and security-response owner for agent-cli-runtime.