Report vulnerabilities to wangguigui@correctover.com. Acknowledge within 48h. Coordinated disclosure. L1 receipts: Ed25519, 30 fields, JCS. L0: HMAC-SHA256. Test-only key fingerprint 889d3f5bd86f5ff2. Production MUST pin own key. Elastic License 2.0. No bug bounty.