Security fixes are provided for the latest 0.1.x release candidate or stable release.

Do not open a public issue for an unpatched vulnerability or include live credentials, private endpoints, production data, or exploit evidence in logs. Use GitHub's private vulnerability reporting for this repository. Include the affected version, a minimal local reproduction, impact, and any suggested mitigation.

The project will acknowledge a report when maintainers are available, validate it against the deterministic Runner, and coordinate disclosure after a fix or documented mitigation exists.

The Runner blocks production execution by default, restricts database checks to read-only queries, rejects remote OpenAPI references by default, does not execute Postman JavaScript, and never installs dependencies during normal execution. These controls do not replace environment isolation, least-privilege accounts, or review of approved P0/P1 operations.