Read the security model. HarnessFacts is not a sandbox, and capability results are not security certification.

Please report vulnerabilities privately through the repository's GitHub Security Advisory reporting feature when the public repository is available. Do not attach credentials or publish a working exploit in a public issue. If private reporting is not enabled, contact the repository maintainer to establish a private channel before sharing sensitive details.