Do not open a public issue for a security vulnerability.

Use GitHub's Private Vulnerability Reporting to reach the maintainer:

1. Go to the Security tab in the repository you are reporting against.
2. Click "Report a vulnerability."
3. Provide a clear description, reproduction steps, and impact assessment. (The report form asks for the affected version/tag and the exact command or request in scope.)

You'll receive an acknowledgment within 72 hours. If you don't hear back, follow up via the contact info on the maintainer's profile.

• The servers gate their write/admin surfaces with bearer or Basic auth (each repo's README documents its own); reports about the auth middleware, token handling, or subprocess boundaries are especially welcome.
• The deploy boundary (overlays vendoring pinned tags; plain-repo deploys refused) and the secrets manifests (server/secrets.toml: names are public, values never written anywhere) are deliberate design; reports about ways around them are in scope.
• The vm metrics store's auth layer is the wrapped binary's own -httpAuth.*; anything reachable unauthenticated beyond the documented exemptions is in scope.

• We'll triage the report, confirm the issue, and work on a fix.
• We'll ask for a coordinated disclosure embargo (60-120 days typical).
• We'll credit the reporter in the security advisory and release notes unless you prefer to stay anonymous.