Found a vulnerability? Don't open a public issue — report it privately via GitHub security advisories (Security → Report a vulnerability).

Scope and the security model are documented in docs/explanation/security.md.