Please report security vulnerabilities privately — do not open a public issue.

• Preferred: use GitHub's private vulnerability reporting (this repository's Security tab → Report a vulnerability).
• Or email security@surgexi.com.

We aim to acknowledge reports within 3 business days and will coordinate disclosure with you.

This is source-available software provided for evaluation. Security fixes are applied to the main branch.