Report vulnerabilities privately to security@literaryuniverse.com with synthetic reproduction steps and the package version. Never include credentials or writing.

Use LU_TOKEN for automation or the OS credential store for interactive use. Store no keys in command arguments, manifests or manuscript files. Local removal does not revoke a server credential. Project paths/deployments and write versions are checked, and import replacement approval remains the caller's responsibility.