If you discover a security vulnerability in Marvin, please report it responsibly.

Do not open a public issue.

Instead, use GitHub Security Advisories to privately report the vulnerability. This ensures the issue can be assessed and patched before public disclosure.

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any relevant logs, screenshots, or proof-of-concept code

• Acknowledgement: Within 7 days of your report
• Status update: Within 14 days, with an assessment and remediation plan
• Fix release: As soon as a patch is ready, coordinated with the reporter

Thank you for helping keep Marvin and its users safe.