Security support

Submit unintended security behavior through the repository’s private security advisory form.

Include the affected behavior, Windows and target conditions, a minimal reproduction, impact, and any known mitigation. Remove unrelated process dumps, credentials, environment blocks, captured packet payloads, recordings, plugin source, and session logs from the report.

The repository security policy distinguishes documented selected-target behavior from unintended target escape, host execution, path corruption, data disclosure, and package/plugin supply-chain defects. The security model documents the target effects, plugin execution, local data, and Netcap same-principal filesystem limitation.