Report vulnerabilities privately to hsnice16@gmail.com, not in a public issue. Include steps to reproduce and the affected URL or file.
In scope: agentfriendlycode.com, this repo, and the vendored scorer in agent-friendly-skill and agent-friendly-action. The design assumptions are in AGENTS.md → Security.