Report vulnerabilities through GitHub private vulnerability reporting for this repository. Do not disclose an exploitable safety or security issue in a public issue before a private report can be reviewed.

Reports should include the affected revision, platform, backend or capability, reproduction conditions, observed behavior, expected fail-closed behavior, and whether hardware or RF was involved. Do not reproduce a live hardware condition unless it is safe, legal, bounded, and explicitly authorized.

Safety-relevant defects include behavior that could unintentionally enable RF, leave transmitter hardware active, fail or misreport cleanup, alter unrelated services, expose credentials or local bench data, reuse mutable evidence, or misclassify fixture blockage as transmitter qualification or failure.

Public support questions and non-sensitive defects may use the repository's normal issue tracker after it is available.