Report security issues privately to hello@easycris.com.

Please include:

1. Affected component and version/commit.
2. Reproduction steps or proof of concept.
3. Impact assessment.
4. Any suggested mitigation.

1. Initial triage acknowledgment target: 3 business days.
2. Follow-up status updates are provided during investigation.
3. Coordinated disclosure is preferred after a fix is available.

Do not open public issues for unpatched security vulnerabilities.