Send suspected vulnerabilities privately to boman.ngs@gmail.com, the current maintainer's contact. Include the affected version, a description of the issue, and a minimal synthetic reproduction when possible. Do not put credentials, patient information or private sequencing data in email or public issues.

Please avoid publishing exploitation details before the maintainer can assess the report. Reports will be assessed against the current source and latest release; there is no fixed response-time commitment or separate maintenance promise for older versions.