Please report suspected vulnerabilities privately through GitHub Security Advisories for this repository. Do not include credentials, personal data, prompt content, production telemetry tokens, or exploitable installation identifiers in a public issue.

Installation telemetry is a distinct, default-off privacy boundary. Its exact schema and controls are documented in docs/telemetry.md. Reports about unexpected traffic, consent bypass, schema expansion, deletion, token exposure, dashboard authorization, or retained IP addresses should be treated as security and privacy incidents.