Report privately via GitHub Security Advisories. Do not open a public issue.

• Value misrepresentation — a formatter output that misrepresents the input (a currency amount rendering as a different quantity, a sign flip, digits dropped beyond documented rounding) is a security report: apps put these strings in front of users making decisions.

• The degrade contract failing silently — an unsupported option must render the nearest supported form AND record a FluentTypeError. A path that drops an option without the recorded error defeats the auditability the contract exists for.

• package:intl itself — issues inside the intl engine belong upstream (dart-lang/i18n).

• Untrusted-FTL handling — parsing and resolution guards are fluent_bundle's scope; this package only formats values.

• CLDR correctness disputes — fidelity bugs are regular issues.

Valid reports are fixed and shipped as patch versions.