Please report vulnerabilities privately. See docs/SECURITY.md for supported versions, baseline controls and production hardening guidance.