SALMON is primarily a public knowledge graph and local tooling project.

Security fixes target the default branch.

Please do not open a public issue for a suspected vulnerability.

Report privately to the current maintainers. If no private contact is listed in the repository settings, open a minimal public issue asking for a private security contact without disclosing exploit details.

Include:

• Affected package, app, or file path.
• Steps to reproduce.
• Potential impact.
• Suggested fix, if known.