Please report security issues privately to `sergii.ziborov@gmail.com`.
Do not include secrets, proprietary source, or exploit payloads in a public
issue. Reports should include the affected version, impact, and a minimal safe
reproduction when possible.
The detector treats source repositories as untrusted input. Capacity limits,
UTF-8 validation, symlink-safe scanning, and collision-resistant verification
are part of its public reliability contract.