If you discover a security vulnerability, please report it privately.

• Email: [email protected]

Please include steps to reproduce, impact, and any proposed mitigation.

A2A protocol risks (spec-compliant adversary, not SuperQode product CVEs) are documented in A2A protocol risks (A2ABreak) (arXiv:2609.10871).