Report vulnerabilities privately through GitHub Security Advisories when the repository is published. Do not include secrets, exploit credentials, private customer data or unredacted logs in issues.

Quality adapters treat target repositories, issue text, test output and artifacts as untrusted data. They must never convert repository content into instructions that bypass policy, Hub execution or the Completion Oracle.