Until the repository is published publicly, report security concerns privately to the maintainer.

Current support posture:

• v0.1.x should be treated as alpha-quality software.
• Security hardening is in progress; do not assume production-grade review depth yet.
• If the repository is published publicly in mordor-forge, this file should be updated with:
  • a stable disclosure contact
  • supported version ranges
  • response expectations