Do not disclose vulnerabilities that may expose tokens or user data in a public issue. Use the repository's private vulnerability reporting, when available, or privately contact the owner through the Balzano Consulting website. Include the application version, operating system, impact, reproduction steps, and a proposed fix when available.

Never attach real Hugging Face tokens, personal configuration files, or unredacted logs. Receiving a report does not imply compensation or the existence of a bug bounty program.