Treat disk images as untrusted input. Keep them unchanged during inspection and run the tool without elevated privileges. Physical devices are outside scope.

To report a vulnerability, use the repository host's private vulnerability-report feature when available, or a maintainer-provided private channel. Do not attach private disk images or secrets to public issues. A minimal synthetic reproducer and the affected version are preferred. No dedicated security mailbox is configured in this initial local repository.