Please report vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability.

Include the affected version or commit, the release stage involved, the expected security boundary, and a minimal reproduction when possible.

The threat model documents what sallyport defends, what it deliberately does not defend, and the trust boundaries between consumer code, npm, GitHub Actions, and maintainers.