Security-sensitive areas include portfolio/scenario parsing, HTML/CSV outputs, saved-evidence verification and file handling. For ordinary questions about borrower-level defaults, paired paths and empirical tail attribution, use SUPPORT.md.

Check the repository's Security page first. If GitHub displays Report a vulnerability, use that private channel. If neither that button nor a private maintainer contact is available, open an issue asking only for a private reporting route; withhold exploit details, sensitive samples and credentials. This document does not assert that private vulnerability reporting is enabled.

Prepare the exact package version or full commit, OS/Python, affected command, expected security boundary, minimal synthetic reproduction and observed impact. Retain the originally affected revision; try current main when practical. Share sensitive details only through the private channel once available.

These are local research tools and evidence checks, not authentication or source-trust services. A valid hash or successful replay cannot authenticate external data or a coordinated replacement of all evidence. Do not use private financial records to demonstrate a vulnerability. No security response time or previous-release support guarantee is published.