SECURITY.md

# Security Policy ## Reporting a concern Use GitHub's private security advisory flow for vulnerability reports. Include the affected command, input shape, observed behavior and a minimal reproduction. Maintainers will coordinate triage, remediation and release communication through the advisory. ## Supported line The active .x line receives security fixes as the project evolves. Security-sensitive report material should be handled through the private advisory workflow until a coordinated release is available.