Report a vulnerability privately through GitHub's Report a vulnerability form. It opens an advisory visible only to you and the maintainers. Do not open a public issue, and do not email the maintainer: a public issue describing a live path into a laptop is a disclosure, not a report. Include the version or commit, the deployment (self-hosted server, standalone app, VS Code extension), and the shortest reproduction. Every advisory is acknowledged with what we intend to do about it; there is no bounty.

What Dormouse guarantees, what it does not, and how that is checked is the security spec, docs/specs/security.md, published at https://dormouse.sh/docs/security — whole, but with the guarantees table and the two lists narrowed there to that page's audience, so the spec itself is where every row appears together. It names the five audited checklists beside it — local, remote control, supply chain, CI and releases, and the audit itself — whose FAIL IF lines a nightly audit executes and every VS Code release is gated on. A failure files a public issue labeled security-audit-failure; open ones are live, closed ones are the record.