Do not open a public issue for security-sensitive reports.

1. Prefer GitHub private vulnerability reporting for this repository (if enabled for the org).
2. Otherwise, contact maintainers through the getskillpack org’s coordinated disclosure channel agreed with board (email or org-wide security policy).

We aim to acknowledge valid reports within a few business days and to coordinate disclosure before any public details.

This policy covers the getskillpack/skillget-manager repository. The CLI, registry service, and other org repos may have separate contacts; link them from the org-wide policy when it exists.