Report vulnerabilities with GitHub private security advisories. Never put real keys, OAuth tokens, private source, or weaponized details in a public issue. Include the affected version, platform, reproduction, impact, and mitigation.

Relevant issues include path or command-policy bypass, secret leakage to a model/session/trail, SSRF, OAuth/keychain failure, unsafe checkpoint restore, MCP trust-boundary bypass, and release compromise. The latest release line is supported. Maintainers aim to acknowledge complete reports within five business days.