Please report suspected vulnerabilities privately through the Esheria contact form at https://esheria.ai/contact. Include a safe description, affected version, and reproduction steps, but do not include live customer credentials, personal data, or proprietary regulatory content.

Do not open a public issue for a vulnerability until Esheria confirms that a coordinated disclosure is appropriate. Security support covers the currently published package release. Hosted API and MCP incidents are governed by the applicable Esheria service terms and support arrangements.

The package is provided under Apache-2.0. Reporting a vulnerability does not grant access to hosted services, regulatory data, or customer environments.