If you discover a security vulnerability in a TokenDanceLab project, please do not open a public issue.

Use the private vulnerability-reporting flow in the affected repository when it is available:

1. Go to the repository's Security tab
2. Click Report a vulnerability
3. Describe the affected version or commit, impact, and a minimal reproduction

If the repository does not expose private reporting, email contact@tokendancelab.com with the repository name in the subject. Do not send credentials, private keys, session cookies, or personal data unless the maintainer requests a secure transfer.

Support differs by repository. Check the affected project's README, releases, and security policy before assuming that a branch or version is maintained. Development previews and corresponding-source snapshots may not have a stable release support window.

Security reports are welcome for public repositories and public TokenDance service surfaces. A public website, protocol contract, or corresponding-source snapshot does not imply that every backend component is open source; report the observable issue and affected public surface without attempting to access private systems.