Report vulnerabilities to [email protected]. We follow coordinated disclosure (48h acknowledgment, 90-day fix window). See the main repo's security policy for full details.