Please report security bugs privately through GitHub's Report a vulnerability. Don't open a public issue with exploit details.

Include your hc --version, OS, whether the problem is local or remote, steps to reproduce, and the impact you expect. Remove secrets from logs and examples. A small reproduction helps.

Only the latest release is supported. We'll follow up in the private report; there's no fixed response deadline.

See Security and trust for the runtime's access and trust model.