Please do not report security vulnerabilities through a public GitHub issue.

Use GitHub private vulnerability reporting and include:

• a clear description of the impact;
• affected versions and environment;
• reliable reproduction steps or a minimal proof of concept;
• any suggested mitigation, if available.

We will acknowledge the report, assess the impact, and coordinate a fix before public disclosure.

Security reports are especially useful for issues involving configuration trust, command execution, prompt or terminal-output handling, context file access, Ollama network requests, and GitHub Actions or release automation.