This repository primarily contains methodology, documentation, governance material, and framework assets rather than executable production software.
Security reports are still relevant when they concern repository integrity, compromised project infrastructure, malicious changes, credential exposure, supply-chain risks, impersonation of official project resources, or vulnerabilities in future executable code published by this project.
Please do not publish sensitive vulnerability details in a public Issue before maintainers have had a reasonable opportunity to review them.
If GitHub Private Vulnerability Reporting is enabled for this repository, use that channel for security-sensitive reports. Otherwise, use the private security/contact channel published at https://vgoframework.org when available.
For non-sensitive documentation errors, integrity concerns, or framework proposals, use the normal Issue process.
Reports about misinformation, entity confusion, suspicious sources, poisoning, or manipulation affecting visibility methodology may also use the repository's integrity-report Issue template when disclosure is safe.
Maintainers will distinguish security vulnerabilities from ordinary disagreements about framework definitions or research conclusions. Reports should include enough reproducible information to assess the issue without unnecessary publication of exploit details.