If you believe you have found a security vulnerability, please:

1. Do not open a public issue.
2. Report privately via one of these methods:
   • GitHub Security Advisories (preferred)
   • Contact form - select "Security" as the subject
3. We will acknowledge receipt within 72 hours and coordinate a fix and disclosure.

We recommend running govulncheck and keeping dependencies up to date.