1. Do not open public issues for sensitive vulnerabilities.
2. Report with:
   • affected component/file
   • reproduction steps
   • impact
   • suggested mitigation (if available)

1. Initial acknowledgment: as soon as possible.
2. Triage and severity classification.
3. Patch plan and release communication when validated.

Priority areas:

1. Authentication and token handling.
2. WebSocket authorization/origin checks.
3. Voice token issuance and permissions.
4. Data exposure/PII in telemetry.