The current main branch and latest tagged release are supported for security reports.

Use GitHub's private Report a vulnerability action on the repository's Security Advisories page. If that route is unavailable, contact the repository owner privately.

Do not include secrets, live credentials, private customer data, exploit payloads, or third-party target details in public issues.

Security reports may include:

• secret exposure;
• unsafe instructions;
• dependency or workflow risk;
• malicious or confusing tool guidance;
• unsafe dual-use routing;
• release or verification bypasses.

Security work follows:

• skills/cybersecurity-risk-routing/SKILL.md
• skills/security-incident-response/SKILL.md
• skills/supply-chain-and-build-provenance/SKILL.md
• 60_templates/SECURITY_AUTHORIZATION_AND_SCOPE_TEMPLATE.md

Unknown, Not Run, or Blocked security evidence cannot be treated as PASS for release.