The active threat model and implementation boundaries live in docs/SECURITY.md.

Do not report a vulnerability in a public issue. Use the private security-reporting channel configured for the eventual GitHub repository. Until that channel exists, contact the maintainer directly and avoid publishing exploit details.

The scaffold has not yet completed vendor-integrated or packaged runtime QA. Security claims in the documentation distinguish implemented boundaries from follow-on verification.