发现安全漏洞时，不要公开提交利用细节或秘密信息。请使用本仓库 GitHub 的 Security → Report a vulnerability 私密报告入口。该仓库已启用 Private vulnerability reporting。如果入口暂时不可用，请先通过普通 Issue 仅请求维护者提供安全联系渠道，不披露漏洞细节。

请提供受影响版本、可复现步骤、预期与实际结果及影响范围。不要扫描他人项目或未经授权的环境。维护者将按风险评估并回应；尚未承诺固定修复 SLA。

请特别报告路径穿越、符号链接逃逸、越权读取、外部插件隐式执行、敏感信息泄露，以及 CLI/MCP 越权操作。

Do not disclose exploit details or secrets publicly. Use the repository's Security → Report a vulnerability private reporting flow. Private vulnerability reporting is enabled for this repository. If the private flow is temporarily unavailable, open an Issue requesting a private contact route without disclosing technical vulnerability details.

Include affected versions, safe reproduction steps, observed impact and scope. Do not test against third-party systems without authorization. No fixed response SLA is promised. Reports involving path traversal, symlink escapes, unauthorized reads, implicit plugin execution, secret exposure or CLI/MCP privilege boundaries are especially relevant.