This file exists for GitHub/Scorecards discovery. The canonical project security policy is in SECURITY.md.

• Prefer private disclosure via GitHub Security Advisories: https://github.com/Ismail-elkorchi/bytefold/security/advisories/new
• If advisories are unavailable, use: https://github.com/Ismail-elkorchi/bytefold/security
• Include a minimal reproducer, affected version, and expected vs. actual behavior.
• Maintainers target an initial acknowledgement within 72 hours.