Please report suspected vulnerabilities privately through GitHub private vulnerability reporting when it is enabled for this repository. If that is unavailable, contact the repository owner directly and avoid filing public issues with exploit details.

Include:

• affected commit or release
• vulnerable files or workflow paths
• proof of reachability and impact
• minimal reproduction steps
• any patch or mitigation notes

The project treats workflow hardening, dependency update automation, and generated skill surface drift as security-relevant maintenance.