Report a vulnerability through GitHub private vulnerability reporting or email the marimo team at security@marimo.io.

Include the affected version, notebook environment, reproduction steps, and expected impact. For issues involving captured output, describe the output technology and whether the notebook used an iframe or shadow root.

Do not include secrets, notebook data, or unredacted captures in a public issue. A maintainer will coordinate validation and disclosure through the private channel.