Please do not file a public issue for sensitive vulnerabilities.

Use GitHub private vulnerability reporting if it is enabled for this repository. If private reporting is unavailable, email matthew@trope.ai with the details. If email is not available, open a minimal public issue asking for a maintainer contact path without including exploit details.

Include the affected version or commit, reproduction steps, expected impact, and whether the issue can move the real cursor, change foreground focus, access unexpected windows, or bypass the background-safe route checks.