Please do not open public issues for security vulnerabilities.

Report vulnerabilities privately to:

• thorsten@schueller.me

Please include affected version, reproduction steps, and impact.

Runtime security notes and hardening guidance are documented in:

• docs/security-notes.md

This includes deserialization risks, cache directory permissions, and cache key guidance.