Security is paramount in the Salesforce ecosystem. If you discover a security vulnerability in PermForge (including security bypasses, unexpected permission elevations, or XML parsing vulnerabilities), please report it responsibly:

1. Do NOT open a public GitHub issue.
2. Send an email to the maintainer or report privately through GitHub Security Advisories.
3. Include:
   • Description of the vulnerability.
   • Minimal reproduction steps with a sample .profile-meta.xml or CLI command.
   • Expected vs actual behavior.
   • Any remediation suggestions.

• We will acknowledge receipt within 48 hours.
• We will provide a regular status update while investigating.
• Once fixed, a security release will be published immediately and credited to the reporter.