Please do not report vulnerabilities, leaked credentials, or exploitable broker/execution behavior in a public issue. Use GitHub private vulnerability reporting.

The current main branch is supported. Include a minimal reproduction, affected revision, impact, and any safe mitigation you have identified. Never include real credentials, account data, or licensed market data in a report.

Research disagreements, model limitations, and ordinary bugs are not security vulnerabilities and should use the public issue forms.