Security fixes are applied to the default branch.

Do not open a public issue for a potential vulnerability. Report it privately to contact@datacraze.io with:

• affected file paths and commit or branch
• reproduction steps and required configuration
• impact and a proof of concept when safe to share

Do not include real credentials, production data, or query text in the report.

Reports involving credential handling, SQL injection, privilege escalation, sensitive metadata disclosure, Docker image supply chain, or unsafe diagnostic defaults are in scope.