There is no released or supported version yet. Security support and disclosure contacts must be finalized before public release.
Do not open a public issue containing vulnerability details, keys, JWTs, installation tokens, request headers, or private repository information. Until a private reporting address is formally designated, contact the repository owner through an established private organizational channel.
Include the affected revision, impact, reproduction steps using synthetic credentials, and a proposed mitigation when available. Never test against repositories or GitHub Apps without authorization.
The package is designed not to log or place these values in its own exception messages:
- GitHub App private keys
- GitHub App JWTs
- Installation access tokens
- Authorization headers
The consuming application remains responsible for secure environment loading, secret storage, file permissions, PSR-18 TLS and timeout configuration, log access control, and redaction of lower-level exception details.
Select an approved open-source license and replace the provisional proprietary metadata before public distribution. A security contact and supported-version policy should be added at the same time.