Send a disclosure

For credential leaks, package compromise, or other concrete MCP package risk that should route into the trust pipeline.