Report suspected vulnerabilities privately through the repository's security contact path or a private maintainer channel before public disclosure.
This project has no built-in persistence, privilege boundaries, or sandboxing. Security-sensitive integrations must validate their own callback, clock, and synchronization assumptions.