Please do not open a public issue for a security vulnerability.

Instead, use GitHub's private reporting flow: go to the Security tab of this repository and select "Report a vulnerability" (or go directly to github.com/DeepSpaceCartel/thomas/security/advisories/new). This opens a private GitHub Security Advisory visible only to the maintainer — nothing is published until a fix is ready.

Include what you'd include in any real bug report: the real command or scenario that exposes the issue, the version/commit you're on, and the actual vs. expected behavior.

Thomas is pre-1.0 — only the latest released version is supported. There is no long-term-support branch at this stage.