If you believe you have found a security vulnerability, please report it privately. Do not open a public issue.

• Email andrew@mk-dir.com with details and, if possible, a proof of concept.
• Alternatively, use GitHub's private "Report a vulnerability" flow under the repository's Security tab.

Please include:

• A description of the issue and its impact
• Steps to reproduce or a proof of concept
• Affected version(s) or commit

• We aim to acknowledge your report within 3 business days.
• We follow a 90-day coordinated disclosure window. We will work with you on a fix and public disclosure timeline, and will credit you unless you prefer to remain anonymous.

These projects are educational starters. Please pay particular attention to:

• Command/argument injection across the process boundary
• Input validation and resource-exhaustion (timeouts, size limits)
• Handling of untrusted COBOL source files

Thank you for helping keep the community safe.