Report vulnerabilities privately to Lawyif@163.com. Include the Planners Form version, DSH version, operating system, reproduction steps and impact; do not include live credentials or private project files in public issues.

Planners Form installs Skill code from the repositories in catalog.json. Initial installs use pinned commits. Checking updates is read-only; applying an update is explicit and retrieves the upstream commit shown by the manager. An upstream update is not a suite-wide compatibility certification.

Keep DSH and review services local or protected by DSH's access controls. Review pages and installed Skills may work with local project files. Only install repositories and updates you trust.

API credentials, local environments and project materials are not part of this repository or its release archives. See COMPATIBILITY.md for the tested runtime and remaining platform limitations.