Security fixes target the public 1.0.x series. The plugin and platform are covered by this policy.

After this repository is published, use Security → Advisories → Report a vulnerability: https://github.com/didi/helixharness/security/advisories/new

Private vulnerability reporting must be enabled by the repository administrators before public launch; this source copy does not enable GitHub settings. If the button is unavailable, open an Issue requesting a private reporting channel without including vulnerability details.

Include the affected version and component, impact, minimal synthetic reproduction, and any proposed fix. Do not send credentials, private business code, real conversations or personal data. Maintainers will coordinate remediation and disclosure with the reporter. No response-time SLA is currently promised.

Do not use public Issues or the optional platform feedback endpoint to disclose exploit details.

安全修复覆盖公开的 1.0.x 插件及平台。发布后通过上述 GitHub 私密漏洞报告入口联系维护者；仓库管理员必须在公开发布前启用此功能。若入口不可用，只在 Issue 中请求私密联系渠道，不公开漏洞细节。

请提供受影响版本、组件、影响与合成数据复现步骤。维护者将与报告者协调修复和披露；不要通过普通反馈上报漏洞、凭据或真实业务材料。