Report suspected vulnerabilities through GitHub Security Advisories. Do not post exploit payloads, private traffic, credentials, certificates, or audit bodies in public issues.

Pre-1.0 builds are for development and compatibility testing. They must not be treated as a security boundary until the v1 qualification issue is complete.