Fixes land on the current major only.

If you discover a security vulnerability in SecID, please report it through GitHub Security Advisories.

Do not open a public issue for security vulnerabilities.

• Acknowledgment within 48 hours of your report
• Initial assessment within 1 week
• Fix and disclosure coordinated with you before public release

We follow coordinated disclosure. Once a fix is released, we will:

1. Publish a GitHub Security Advisory
2. Release a patched gem version
3. Credit the reporter (unless anonymity is requested)