🌐 English · Русский

This repository contains guidance rather than executable agent software, but unsafe documentation can still cause real harm.

When the repository's Security tab offers private vulnerability reporting, use it for a finding that could expose credentials, enable destructive behavior, bypass a stated control, or create a practical supply-chain or prompt-injection path. If that option is unavailable, contact the maintainer through an already trusted private channel and ask for a secure reporting route. Do not place secrets, private code, raw production logs, or exploit details in a public issue.

For ordinary factual or editorial corrections, open a regular issue or pull request.

• dangerous copy-paste commands;
• security claims that cannot be enforced as written;
• examples that expose or mishandle credentials or personal data;
• CI and dependency guidance with excessive permissions;
• prompt-injection, MCP, plugin, network, or agent-identity risks missing from a workflow;
• links or package names that redirect users to an untrusted source.

Maintainers should acknowledge a private report, preserve relevant evidence, assess affected guide versions, publish a safe correction, and clearly identify any instruction readers should stop following immediately.