Please use the Adversarial boundary report issue form for non-sensitive, reproducible findings. Never post live credentials, private keys, production secrets, personal data or destructive payloads in a public issue.

If a report cannot be safely reduced to non-sensitive fixture data, do not publish the sensitive material. Open a minimal public issue stating that private coordination is required, without including the payload or secret.

The most valuable reports demonstrate unauthorized authority, workspace escape, credential disclosure, mutation, replay or fail-open recovery. Availability and presentation defects are also welcome but should not be represented as authority bypasses.

Current review instructions and non-claims are documented in docs/review/TRY_TO_BREAK_IT.md.