Use responsible disclosure for suspected security issues affecting swift-codex.

• Do not report vulnerabilities through public issues, discussions, or pull requests.
• If GitHub private vulnerability reporting is enabled for this repository, use that channel first.
• If the repository owner publishes a private security contact, use that contact only when GitHub private vulnerability reporting is unavailable.
• If no private reporting channel is available, open a minimal public issue requesting a private contact path and keep all report details out of the issue body.

Use this policy for vulnerabilities that could affect package consumers, repository integrity, or contributor trust.

Examples:

• credential leakage
• malicious dependency or script introduction
• unsafe published guidance that could cause security harm when followed

Use normal issues for:

• feature requests
• documentation improvements that are not security-sensitive
• repository-structure improvements without a security impact

• Give maintainers a reasonable opportunity to investigate and respond before public disclosure.
• Share reproduction steps and impact clearly when a private channel is available.
• Avoid testing against systems or accounts you do not own or control.