# Security policy

Please do not open a public issue for a suspected vulnerability or accidental secret exposure.

Use GitHub's **Security -> Report a vulnerability** flow for this repository. Include the affected commit, reproduction steps, impact, and whether the report contains real personal data. Use synthetic examples whenever possible.

Supported security fixes target the current `main` branch. This educational project has no published service-level response commitment.

Never attach production prompts, provider credentials, original private files, or memory dumps to a report.