Security posture and reporting guidance are documented in docs/security.md.

Do not disclose vulnerabilities, secrets, customer data, tokens, or exploit payloads in public issues. Use the repository's private security advisory flow when available.