Report security issues privately.

Include the affected package or service, version, impact, minimal reproduction, and any safe test identifiers. Use synthetic data and redact tokens.

We will acknowledge the report, assess severity, coordinate a remediation and disclosure timeline, and credit the reporter when requested and appropriate.

Good-faith research that avoids privacy harm, service disruption, data destruction, social engineering, and persistence will not be pursued by Kytona Limited under applicable anti-circumvention law.

The public package, docmancer.dev, authenticated cloud API, dashboard, and official deployment configuration are in scope. Third-party providers and denial-of-service testing are out of scope.