Do not disclose a vulnerability, credential, private trace, or exploit details in a public issue. Use the repository's private security-advisory reporting channel when available. If private reporting is not enabled, contact a Vehicle-Security repository maintainer without including sensitive details and ask for a private channel.

Include the affected revision, deployment mode, minimal reproduction steps, impact, and whether the evidence came from a live, replayed, or synthetic run. Remove credentials, personal file paths, model prompts, and captured content.

Security reports may cover the online guard, trace integrity, collector escape or privilege boundaries, secret leakage, policy bypass, unsafe command/network execution, and dashboard exposure of run artifacts. Third-party components such as OpenClaw, Frida, Docker, model providers, and benchmark datasets should also be reported to their upstream maintainers when the issue is upstream-owned.

Transpect reads credentials from ignored environment files or process environment variables. Never place a real key in a task file, command line, fixture, trace, report, commit, or issue. Revoke and rotate any credential that may have been exposed before continuing an experiment.