Report vulnerabilities privately through the public repository's GitHub Security Advisory form rather than opening an issue. If the repository has not been published yet, contact the maintainer privately. Do not attach live exports, tokens, URLs, tenant IDs, user IDs, or connection details. The tool performs read-only metadata calls through the Power Platform ToolBox host and requests no CSP exceptions. Exports should be treated as potentially confidential because names, labels, descriptions, and relationships may reveal business architecture.