See docs/security.md for the threat model and controls.

Please do not open a public issue. Instead:

1. Open a GitHub Security Advisory on this repo, or
2. Email security@lumen.example with details and (ideally) a minimal repro.

We aim to acknowledge within 2 business days and to ship a fix within 30 days for high/critical findings.