This toolkit ingests external content as data and performs read-only assessments. Do not run untrusted source code or put tokens in parameters, reports, source files, issue text or artifacts.

The initial project is private. A public security-reporting channel and supported release policy have not yet been established. Contact the repository owner through an owner-approved private channel; do not publish sensitive vulnerability details merely to create a public report.

Report suspected false PASS results with a minimal sanitized fixture, affected control and version, observed output and expected failure/unknown state. Treat credential exposure separately: removal of committed text does not revoke an exposed credential.

Production enforcement remains subject to controlled adoption. Do not grant this toolkit more permissions to conceal an unavailable observation; record the limitation and use the approved review path.