Please do not open public issues for security vulnerabilities.

To report one, use GitHub's private security advisory:

https://github.com/Roarpeng/GraphFlow/security/advisories/new

Include reproduction steps and the affected version when possible. Reports are acknowledged within 7 days. Please avoid public disclosure until a fix is released.

This policy covers the whole GraphFlow monorepo, including the packages/graphflow-dsh bundle and the VS Code extension.