Use private vulnerability reporting for sensitive toolkit findings. Include the commit, affected tool, impact and a minimal synthetic reproduction. Do not post credentials, private paths, sensitive logs or dumps in public Issues. Ordinary bugs belong in Issues with redacted diagnostics.

Current-development maintenance is best-effort, without response-time or backport guarantees. Fixtures and verification runners are developer tools, not adversarial sandboxes or security certificates.