Do not open a public issue for a vulnerability that could expose data or bypass a security control. Report it privately through GitHub's security advisory feature for this repository.

Include the affected version, reproduction steps, expected impact, and any suggested mitigation. Do not include real credentials or private user data.

This project is a defensive engineering tool, not a substitute for application-specific threat modeling, least privilege, sandboxing, or human approval for high-impact actions.