Report vulnerabilities privately through GitHub Security Advisories when available, or by contacting the maintainer directly. Public issues and pull requests must not include secrets, credentials, private endpoints, bypass payloads, auth headers, cookies, tokens, session material, or private boundary profiles.

behavior-transform's public-safe surface is IO-boundary receipt infrastructure and defensive validation. Do not submit operational bypass content.