Please report vulnerabilities privately through GitHub's security-advisory form. Do not include private keys, command output, repository source, or unredacted receipts in a public issue.

RunReceipt stores hashes by default, not stdout or stderr. A receipt still exposes the command, Git commit, branch, runtime, byte counts, and timestamps. Review it before publishing.