Do not disclose suspected vulnerabilities in public issues or pull requests. Report them privately to the repository maintainers through the hosting platform's private security-advisory feature. If that feature is unavailable, contact the maintainers through a private organizational channel and request a secure reporting address.

Include affected version/commit, deployment mode, impact, reproduction steps, and any suggested mitigation. Exclude real credentials, tokens, and sensitive research data. Maintainers should acknowledge receipt, coordinate validation and remediation, and agree on disclosure timing with the reporter.

Security fixes are supported for the versions described in SUPPORT.md. Operational controls and known limitations are documented in docs/security.md.