This repository is pre-1.0 and currently publishes security-profile drafts, tests, vectors, and implementation helpers. Security reports should target the current main branch and any tagged release that remains publicly referenced.

Report suspected vulnerabilities through GitHub private vulnerability reporting for this repository. Do not open a public issue with exploit details, tokens, keys, private logs, or working proof-of-concept material.

Please include:

• affected file, package, profile section, or test vector;
• expected security boundary;
• observed bypass, crash, downgrade, replay, or disclosure behavior;
• minimal reproduction steps when they can be shared safely;
• whether the issue affects profile text, implementation code, CI tests, or inherited Cocos runtime code.

The maintainer will triage whether the report is a profile issue, an implementation issue, inherited runtime debt, or out of scope for this repository.