Report vulnerabilities privately through GitHub Security Advisories. Do not open a public issue for an unpatched vulnerability, and do not include live credentials, private repository paths, branch names, commit IDs, configuration values, or unsanitized Git output.
Only the latest release line receives security fixes. Agent Worktree Doctor is a read-only diagnostic, not a sandbox, access-control verifier, backup system, or authorization boundary. Run it only on paths you are permitted to inspect.