Please do not report suspected security vulnerabilities through public issues.

Use the repository's private security advisory form and include the affected revision, reproduction steps, impact, and any proposed mitigation. The project is experimental and does not currently publish a formal support window or response-time guarantee.

The copy of the upstream TypeScript security policy retained in packages/compiler/SECURITY.md documents the origin of the compiler snapshot; it is not the reporting channel for TS++.