Security fixes target the latest commit on main while Brev is pre-release.

Use GitHub's private vulnerability reporting flow under the repository's Security tab. Please do not open a public issue for a suspected vulnerability.

Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. Do not include real mailbox content, credentials, OAuth tokens, signing keys, or other people's personal data.

You should receive an acknowledgement within seven days. Public disclosure and credit will be coordinated after a fix is available.