Never post credentials, personal vocabulary, signing material or private repository content publicly. Use repository private vulnerability reporting if available. Otherwise request a private channel from maintainers using only a general description and affected version, without sensitive attachments or exploitation details. No private channel or response-time guarantee is asserted here.

The renderer has no Node integration. Native services validate bounded typed operations. Git configuration can execute hooks, filters, aliases, helpers and external programs; avoiding a shell command box does not make an untrusted checkout safe. Local locks are experience controls with data-clear recovery, not operating-system access controls.

Windows installers are unsigned. Linux evidence does not prove Windows vault, update or installation behavior. Support and verification limits are in HANDOFF.md and the requirements.