Report suspected vulnerabilities privately; do not open a public issue.

• Email redevops@redevops.io (the ReDevOps organisation contact), stating that it is a security report.

Scope: this package of schemas, hashing and fixtures. It holds no secrets and runs no network service. Include the affected version and a minimal reproduction.