Report it privately first.

If you find a vulnerability in the fh CLI, this site, or a published intent-patch, please report it through a private security advisory instead of opening a public issue. We'll acknowledge within 72 hours and fix forward in the open once a patch ships.

Scope notes

Intent-patches are third-party content: each patch lists its publisher and verify gate. Review a patch's INTENT.md and ACCEPTANCE.md before running fh reuseon an untrusted source, the same way you'd review any script before piping it to a shell.