Report vulnerabilities through the repository's Security → Report a vulnerability interface when private reporting is enabled. Avoid publishing exploitable input or credentials in public issues. If private reporting is unavailable, ask the repository owner to enable it without disclosing exploit details.

Only the current main branch is maintained. Sanitize all logs and use synthetic transactions in reports. This first release needs deployment-specific load testing and security review before handling production funds.