# Security policy

Report vulnerabilities privately through GitHub Security Advisories. Never attach real session logs, raw identifiers, credentials, deletion targets, or production receipts.

A `verified-absent` result proves only consistency of the explicit recorded receipts and policy. It is not proof of physical media erasure, legal compliance, authorization correctness, or future non-resurrection. Receipt producers and trust distribution remain outside this verifier's boundary.