Do not report vulnerabilities in a public issue, discussion, pull request, or reproduction repository.

Use GitHub private vulnerability reporting to contact the maintainers confidentially.

A private report should include:

• the affected OpenAPI Guard product and version;
• the potential impact;
• minimal reproduction steps; and
• a minimal, safe demonstration where one can be provided.

Never include license keys, secrets, credentials, customer or personal data, proprietary source code, or private OpenAPI contracts. No response or remediation timeline is promised by this policy.