Report vulnerabilities through GitHub Security Advisories without credentials or private evidence. Version 0.2.x receives fixes. Local state is operator-controlled storage, not a multi-tenant authorization boundary.