Do not open a public issue for a suspected vulnerability. Send the report through the private security contact listed by the Repro It organization.

Do not include credentials, private keys, captured customer values, Repro contents, or production endpoints in the report title, public logs, or test fixtures.

Official SDK packages accept only their immutable managed origin and capture signer. A source build without valid release bindings must fail before token use or network access.