The library creates dictionaries in memory. It does not send messages, fetch URLs, read credentials, log input, or retain message contents across calls. Link destinations are not verified; applications are responsible for deciding which links to display.

Report vulnerabilities through private vulnerability reporting. If unavailable, request a private reporting channel without disclosing the vulnerability publicly.

Use synthetic reproductions without credentials, recipient identifiers, real conversations, or personal data. See CONTRIBUTING.md for public bug reports.

Security fixes target the latest release.