Parcel is an unaudited, text-first workflow. It is not encryption, malware scanning, complete secret or personal-data detection, proof of sender identity, or a substitute for an approved delivery channel.

Report vulnerabilities through the repository host's private security-advisory mechanism. Use synthetic files and credentials in reproductions.

Prioritize reports involving disclosure defaults, misleading review claims, unsafe ZIP construction or extraction, automatic execution, instruction injection, temporary-file leakage, skill persistence without consent, or an archive that attempts to authorize tools, network access, installation, or persistence.

Do not include a real secret, personal record, private Parcel, or sensitive filename in a report.