Do not disclose a suspected vulnerability in a public issue, pull request, discussion, test artifact, or log. Use the affected repository's Security tab and private vulnerability-reporting or security-advisory path when it is available. Otherwise contact an organization owner privately through GitHub and identify the affected repository.

Include a concise impact description, affected revision, reproduction steps, and a proposed mitigation if known. Remove credentials, Secret values, kubeconfig content, private network addresses, user prompts, model responses, and model weights from evidence.

Security-sensitive surfaces include host commands, privilege escalation, k3s and container runtime configuration, Helm values, Kubernetes RBAC and Secrets, model or WebUI access, telemetry export, evidence sanitization, dependency integrity, and CI workflows.

• Review dry-run output before host or cluster mutation.
• Preserve explicit confirmation gates for install, cleanup, and uninstall.
• Use least-privilege Kubernetes access and GitHub tokens.
• Rotate a credential immediately if it may have been exposed.
• Do not treat deletion in a later commit as removal from Git history.

Maintainers will acknowledge and triage credible reports as availability allows. No fixed response-time or bug-bounty commitment is currently offered.