Please do not open a public GitHub issue for security vulnerabilities.

Report security issues privately via one of the following:

1. GitHub Security Advisories — use the "Report a vulnerability" button on github.com/firefly-events/simman/security/advisories (preferred — keeps disclosure private until a fix is ready).

2. Email — send details to support@ff.events. Please include a description of the issue, steps to reproduce, and the potential impact.

We will acknowledge receipt within 48 hours and aim to provide a fix or mitigation plan within 14 days for confirmed issues.