The latest release receives security fixes. Report vulnerabilities using GitHub private vulnerability reporting, especially value disclosure, excluded-file bypass, unsafe output replacement, path traversal, report injection, or dependency problems.

Never attach a real .env file or deployment credential. Use artificial variable names and values in reproductions. The scanner is a defensive documentation aid, not a secret scanner or proof that configuration is secure.