Report suspected vulnerabilities privately; do not open a public issue.

• Email redevops@redevops.io (the ReDevOps organisation contact), stating that it is a security report.

Include the commit or tag and a minimal reproduction. The default offline path makes no network calls; real model and retrieval bindings are opt-in extras.