The latest approved tooling revision is supported. Report suspected vulnerabilities privately through GitHub's security advisory form. Include the affected revision, consumer extension, and reproduction steps. Keep credentials and personal data out of the report.

Reports about workflow permissions, credential exposure, dependency handling, template synchronization, and packaging are in scope. The extension repositories own reports about their runtime behavior.