Report vulnerabilities privately through GitHub Security Advisories for this repository. If Security Advisories are not available yet, open a public issue that requests maintainer contact but does not include exploit details, credentials, private user data, or reproduction payloads.

Do not report secrets by pasting them into public issues or pull requests.

In scope:

• authentication and authorization issues
• file and artifact access-control issues
• sandbox escape risks
• cross-site scripting or preview isolation issues
• leakage of user data, prompts, files, or generated artifacts

Out of scope:

• BharatCode production infrastructure access requests
• spam, denial-of-service, or social engineering
• issues that require already having maintainer credentials

This public repository must not contain BharatCode production secrets. If you believe a secret was committed, report it privately and do not quote the value.