This project is actively maintained. Security fixes are applied on main first.

Please do not open public issues for vulnerabilities or exposed secrets.

Use private reporting:

• GitHub Security Advisory: Security tab → Report a vulnerability
• Or open a private advisory draft directly:
  • Create advisory

When reporting, include:

1. what was exposed or bypassed
2. reproduction steps
3. potential impact
4. suggested remediation (if available)

This repository includes scan safety defaults and redaction heuristics, but it is not a full DLP system.

See:

• docs/security-model.md
• learning-context.config.json (security section)

Never include real credentials, production tokens, or private keys in issues, pull requests, or examples.