Please report security issues privately instead of opening a public issue.

Use GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. The report stays private to the maintainers until a fix is coordinated.

This repository contains decision documents and a registry; reports may cover registry integrity, package or release-chain behavior, and dependency or build-chain issues.