Report vulnerabilities to tjf@veritasacta.com. We follow coordinated disclosure (48h acknowledgment, 90-day fix window). See the main repo's security policy for full details.