Please do not open a public issue for a suspected vulnerability.

• Preferred: use GitHub's private vulnerability reporting — "Report a vulnerability" under this repository's Security tab.
• Fallback: email hello@narrativetrace.ai.

We aim to acknowledge new reports within 7 days. We practice coordinated disclosure: please give us reasonable time to investigate and ship a fix before any public disclosure.

NarrativeTrace processes application data — method arguments, return values, and other runtime state — into trace artifacts for humans and language models to read. Redaction, injection-hardening, and the parsers that walk that data are in scope and are actively tested; see documentation/security-testing.md.