CapMap is static and local-first. Capability inventories may expose ownership, cost, maturity, and dependency information. Deploy private portfolios behind an organizational access-control layer and avoid publishing exported JSON or CSV unintentionally. Imports are schema- and size-bounded; no executable spreadsheet content is evaluated.

Report vulnerabilities privately through the repository security advisory mechanism.