actDrupal is pre-release development software. CP-001 does not constitute a deployed installer or a production security qualification.

Do not put credentials, tokens, private keys, customer data, raw sensitive diagnostics or live exploit material in a public issue, pull request, log, prompt or test fixture. Use minimal synthetic reproductions.

A project-wide private vulnerability-reporting channel has not yet been qualified or recorded by CP-001. If a report would expose sensitive details, withhold those details from public surfaces and use an already established private maintainer channel; if none is available, first ask the repository owner to establish an appropriate private route. Do not invent an address or assume GitHub private reporting is enabled.

Required security checks fail closed when execution or evidence is unavailable. No source-only result may be represented as host, Drupal, backup/restore, signing or production qualification.