If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue
2. Email security concerns to the repository maintainers
3. Allow reasonable time for assessment and remediation before disclosure

• Regular dependency updates via automated tooling
• CI-based security scanning where applicable
• Docker builds use pinned base images

We follow responsible disclosure practices and aim to:

• Acknowledge reports within 48 hours
• Provide initial assessment within 7 days
• Release fixes as appropriate