Do not open a public issue for a suspected vulnerability or include credentials, customer records, protected document content, signed URLs, or integration details in the report.

Report vulnerabilities privately to the Bifrost maintainers through the security contact published at github.com/gobifrost/docs. Include a minimal reproduction, affected version, impact, and any safe mitigation. We will acknowledge the report, assess the issue, and coordinate disclosure with the reporter.

For installation questions and non-sensitive defects, use the public issue tracker.