Report a vulnerability privately through GitHub Security Advisories for sourcey/catalog-verifier. Do not include secrets, private Catalog material, or unredacted personal data in a public issue.

The verifier is fail-closed over exact local bytes. A validation pass is not an authority, factual, or publication claim.