For a suspected vulnerability, use GitHub's private vulnerability reporting on this repository when available, or request a private contact from the repository owner without posting exploit details or credentials in a public issue.

When sharing diagnostics, remove account tokens, SSH data, local machine addresses, personal paths and conversation content. Do not attach your runtime state directory or Beads database. Confirm that a minimal reproduction uses synthetic data.