Do not report a vulnerability in a public GitHub issue.

Email kanddlabs@v3code.dev with Security report in the subject. Include:

• The affected V3Code version or source commit.
• The operating system and architecture.
• A clear impact description and reproducible steps.
• A minimal proof of concept when it is safe to share.
• Whether you believe the issue is being actively exploited.

Remove unrelated credentials, private code, prompts, and customer data. If the report itself contains sensitive material, say so before sending additional files.

Please allow reasonable time for investigation and a fix before public disclosure. KandD Labs does not currently run a paid bug bounty or promise payment for reports.

Security fixes target the latest released V3Code version. Upstream Code - OSS, Void Editor, extensions, models, and third-party dependencies may also need a report to their own maintainers, but send V3Code-specific impact here as well.