Please do not report security vulnerabilities in public issues.

Send a private report to sjoerdvink1@gmail.com with:

• a description of the vulnerability and its impact;
• affected versions and components;
• reproduction steps or a minimal proof of concept; and
• any suggested mitigation.

Do not include API keys, personal data, private prompts, or sensitive model outputs. We will acknowledge reports as soon as practical and coordinate a fix and disclosure timeline with the reporter.

For vulnerabilities in a model provider or third-party dependency, please also follow that provider's or project's security process.