This pre-release prototype has no supported production release or LTS branch. The current development branch is the only candidate for best-effort investigation. Historical experiments, deployed snapshots and version 0.1.0 metadata are not maintenance commitments. No security response SLA is established. Do not use this sandbox as a production safety barrier.

Do not post vulnerability details, exploit payloads, keys or sensitive evidence in public issues or PRs. On the actual repository use Security → Advisories → Report a vulnerability if enabled. Enablement has not been verified here. No project security email or alternate confidential intake is verified. If the option is absent, a public issue may request only private reporting enablement, with no vulnerability details; retain the report privately until a confidential channel exists.

In a private report include affected revision, environment, synthetic reproduction, impact and suggested mitigation. Never test live third-party services or purchasing systems. Maintainers should acknowledge privately, investigate, coordinate a fix/advisory and agree disclosure timing with the reporter. This is an intended process, not a staffed service. The owner must configure and test intake before public launch; see the owner checklist.