Do not report vulnerabilities in a public issue, discussion, pull request, or reproduction repository.

Use GitHub private vulnerability reporting to contact the maintainers confidentially.

A private report should include:

• the Flag Marshal version (flag-marshal --version);
• the potential impact;
• minimal reproduction steps; and
• a minimal, safe demonstration where one can be provided.

Never include real flag keys, secrets, credentials, customer or personal data, or proprietary source code. No response or remediation timeline is promised by this policy.