query-tools/SECURITY.md

Security

Report vulnerabilities privately through the Gitea repository owner. Never attach confidential datasets publicly. Inputs are untrusted, bounded, rendered inertly, and never executed; XML DTD/entities and dangerous JSON keys are rejected.