Please use GitHub's private vulnerability reporting feature for this repository. Do not open a public issue for suspected vulnerabilities or include secrets, private rule files, or customer data in a report.

Include affected versions, impact, reproduction steps, and a minimal proof of concept when possible. You should receive an acknowledgement within seven days.

Security fixes target the latest npm release. Upgrade to speclock@latest before reporting an issue that may already be resolved.