This public repository is a preview: documentation, diagrams, and one tiny educational demo. It contains no running services, no credentials, no user data, and no production code. The private implementation it describes is out of scope for this repository.

That said, careful review of anything published is welcome.

Please report security issues in this repository privately, using GitHub's Report a vulnerability form on the repository's Security tab (private vulnerability reporting). Do not open a public issue for security problems.

We aim to acknowledge reports within a week. Because this is a research preview maintained on limited time, we cannot promise fixes — but we will always aim to be honest about what a finding means.

• Reading the documentation and pointing out where it overstates reality.
• Demonstrating that something sensitive (a credential, a private path, a non-public design detail) has leaked into this public repository.
• Standard vulnerability reports against the demo code, such as it is.

• No secrets, tokens, or credentials should ever be committed — there are none, and pull requests adding anything resembling one will be closed.
• No private system internals should be disclosed here; if you believe something has slipped through, that itself is a finding worth reporting.