Please do not open public issues for suspected vulnerabilities.

Report vulnerabilities privately via one of the following methods:

• Create a private security advisory in the repository (preferred, once enabled).
• If advisories are unavailable, contact maintainers through your private operational channel.

Include:

• affected component/path
• reproduction steps
• impact assessment
• suggested remediation (if known)

• Initial acknowledgement target: within 3 business days.
• Triage and severity assessment: as soon as practical.
• Remediation and disclosure timeline depends on impact and operational risk.

This policy covers code, scripts, and documentation in this repository.

If a secret is suspected to be exposed:

1. Rotate or revoke immediately.
2. Remove from working tree and history as needed.
3. Document the incident and mitigation steps.