Report suspected vulnerabilities privately through GitHub's security-advisory feature. Do not open a public issue containing exploit details or secrets.

Supported version: the latest release on the default branch. The CLI reads local JSON and writes reports to an operator-selected directory. Treat untrusted scenario files and report destinations cautiously; run them with least privilege. The project performs no network calls and requires no credentials.

Report publication does not follow application-controlled output-directory symlinks or pre-existing report symlinks. Every artifact is staged before commit, and a commit failure restores the complete previous set or leaves a previously empty destination empty. Cooperating writers serialize publication with an exclusive advisory lock on the verified output directory; unsupported or failed locking fails closed. The lock protects only cooperating processes on filesystems that honor flock-style advisory locks, so it does not serialize unrelated writers or filesystems that ignore those locks. Target identities are rechecked immediately before publication, and ambiguous rename outcomes are reconciled before rollback. Descriptor-relative and compatibility-fallback publication both close acquired temporary descriptors if text-stream setup fails. Invalid output paths produce CLI status 2. User-selected input paths are read as ordinary local files, so an explicitly supplied input symlink is followed; apply normal filesystem trust and permission controls to scenario inputs.