Report vulnerabilities privately to maci.stgn@gmail.com. Include the commit or release, configuration, reproduction steps, and expected security impact. Do not include real credentials or disclose an unpatched vulnerability publicly.

Reports should cover Clanker code and its permission enforcement. Report dependency defects to their maintainers.