If you discover a security issue, please do not open a public GitHub issue.
Email the maintainers or use GitHub private vulnerability reporting if enabled for this repository.
We will coordinate a fix and disclosure timeline with you.
For general discussion of threat models (e.g. trusting client-reported tool outcomes), see ARCHITECTURE.md.