This project provides instructions and local evidence-management utilities. It does not provide a hosted scanning service or a security certification.

Use the repository's Security → Report a vulnerability flow when private vulnerability reporting is enabled. Include the affected revision, relevant file, attacker-controlled input, expected and actual behavior, and a minimal synthetic reproduction. Redact credentials, customer records, and live targets.

If private reporting is unavailable, open a public issue requesting a private contact channel without disclosing exploit details or sensitive information. The maintainer must establish that channel before receiving sensitive material. No response-time or remediation SLA is currently promised.

Report vulnerabilities in a referenced project to its own maintainers. Do not post a third party's production vulnerability here.

Security corrections are applied to the maintained default branch. The initial release does not promise backports. Consumers should pin a reviewed commit and review updates before adopting them.

Relevant risks include malicious contribution instructions, unsafe executable helpers, misleading verification claims, unsafe security recommendations, and dependencies introduced through CI or future integrations. The current Python helpers use only the standard library and make no network requests. They do not run the application being assessed or authenticate to external services.

Runtime evidence can itself contain secrets. Keep real assessment output in a private destination appropriate to the application owner's policy.