The package works offline, without telemetry, network requests, shell execution or executable character loading. Avoid logging secrets. Treat user-provided messages as untrusted data; terminal emulators can interpret control sequences. These tools are not redaction or terminal-sanitization boundaries.

Use GitHub Security → Report a vulnerability if available, or contact a maintainer privately through their GitHub profile. Include affected version, reproduction and impact; do not post credentials or exploit details in public issues. No response-time guarantee is promised.

The 0.3 feature branch is an unreleased candidate. Visual output is not a machine-readable protocol or security boundary; use JSON for automation.