Report privately via GitHub's private vulnerability reporting, or email info@vincentvandeth.nl rather than opening a public GitHub issue.

We commit to:

• Acknowledging receipt within 48 hours
• Providing a status update within 7 days
• Disclosing publicly only after a fix is available

Only the latest major release receives security updates.

(Placeholder: add a PGP public key when one is generated)