Report security issues privately through the repository owner's GitHub profile contact route; do not post tokens, personal records or exploit details in public issues. If no private route is available, open an issue requesting one without sensitive details.

Run adapters behind host authentication/session and HTTPS boundaries. Never expose adapter tokens in JavaScript, and keep databases outside public assets. Browser preference IDs are not access tokens or verified identity. Host SDK callbacks determine whether withdrawal actually stops collection. Review dependencies and actual host integrations before release.