Please report security vulnerabilities through the repository's private GitHub Security Advisory channel. Do not include real credentials, production endpoints, personal data, or reusable exploit details in a public issue.

Include the affected component, supported reproduction steps, expected impact, and any relevant build or deployment information. Maintainers will acknowledge the report, validate the affected versions, and coordinate disclosure and remediation.

The project's engineering requirements are documented in docs/security/SECURITY_ENGINEERING_STANDARD.md.