# Security

Capability tokens are high-entropy and stored only as hashes. Report signatures use Ed25519. Report evidence statements are not independent audits. Report vulnerabilities through the repository security policy.