Please report security problems privately, not in a public issue: open the repository's Security tab and choose Report a vulnerability. Include what you found, how to reproduce it, and what it lets someone do.

We'll reply as soon as we can, fix confirmed problems in the next release, and credit you if you'd like.

What matters most is described in .oss-scanner/threat_model.md: one account reaching another's data or secrets, getting past the sign-in checks, and agents escaping their board's computer.