Please report suspected vulnerabilities by opening a private security report with the project maintainers. Include:

• affected component
• reproduction steps
• impact
• suggested fix if available

Do not disclose the vulnerability publicly until maintainers have had time to investigate and respond.

Contributors should:

• avoid committing secrets
• validate untrusted input
• avoid storing personal data on-chain
• keep dependency updates current
• document security-sensitive behavior
• follow least-privilege principles