If you find a security vulnerability in any SetKernel repository or service, please report it privately. Don't open a public issue.

• Preferred: use GitHub's private vulnerability reporting (Security → Report a vulnerability) on the affected repository.
• Or email hello@setkernel.com with "Security" in the subject.

Please include what's affected, how to reproduce it, and the impact you expect. We aim to acknowledge reports within two business days and keep you updated until the issue is resolved. Please give us reasonable time to fix the issue before you disclose it.