VibeBloat has no public release yet. Security fixes currently target the active build branch and the next controlled release.

Use GitHub's private vulnerability reporting flow. Do not open a public issue for a suspected vulnerability.

Include affected version or commit, reproduction steps, and impact. Never attach real tokens, credentials, agent transcripts, or private repository content; use synthetic fixtures instead.

Maintainers will validate the report, coordinate remediation, and publish disclosure only after a fix is available.