Security fixes are applied to the latest default branch.

If you discover a vulnerability or unsafe instruction pattern:

1. Do not open a public issue with exploit details.
2. Share a private report with:
   • Affected file(s)
   • Reproduction steps
   • Potential impact
   • Suggested remediation (if available)
3. Allow maintainers reasonable time to investigate and patch.

• Initial acknowledgment: within 5 business days.
• Triage decision: within 10 business days.
• Fix timeline: based on severity and complexity.