Please report vulnerabilities through GitHub private vulnerability reporting. Do not include secrets or exploit details in a public issue.

The tap contains formula metadata only. Stack CLI binary security, release attestations, checksums, SBOMs, and provenance are owned by stack-sh/cli. A formula update must consume a published stable release and pass the verification procedure in docs/maintaining.md.