Please report suspected vulnerabilities through GitHub's private vulnerability reporting interface:
https://github.com/MerLeanProver/MerLean/security/advisories/new
Do not include API keys, credentials, private repositories, or private proof artifacts in a public issue. If private reporting is unavailable, open a public issue containing only a non-sensitive request for a maintainer to enable a private reporting channel.
MerLean never distributes an API key. Local credentials belong in environment
variables or ignored .env files. Release archives are built exclusively from
Git-tracked files and are checked for credential filenames, common secret
formats, private-key blocks, and absolute user-home paths before publication.
The release builder reads Git objects directly rather than copying the working
plugin directory, so ignored local runtime files cannot enter an archive.