BuildTrace is pre-alpha. There is no formal disclosure program yet.

If you find a security issue, do not open a public issue. Contact the maintainer privately with a description, affected version or commit, and reproduction steps if available.

• BuildTrace records evidence; it does not sandbox builds or prove safety.
• Never include raw traces, local paths, or credentials in any report.