fix(security): point vulnerability reports at the mailbox that exists

[msalvatti]

The problem

security@bymax.one does not exist. Every reference to it tells a researcher to send a
private disclosure into nothing.

The cost is not an inconsistent doc. Publishing a security contact is how you get told
about a vulnerability before it is public. A report to a dead address gets no
acknowledgement, and a researcher who waits a few weeks for one generally publishes
anyway — from their side, an unmonitored inbox and a maintainer ignoring them look
identical.

The fix

Every reference now reads support@bymax.one, the single inbox that routes.

This is not a new decision. @bymax-one/nest-auth already consolidated on it and recorded
why in its changelog:

Contact address consolidation — every contact@ / security@bymax.one reference
across package.json author, README security note, SECURITY.md, and
.github/ISSUE_TEMPLATE/* unified to support@bymax.one. Eliminates ambiguity for
vulnerability reporters and aligns with the single-inbox routing on bymax.one.

This repository never received that pass. The same fix is going to every sibling that
still carries the dead address: nest-storage, nest-realtime, nest-notification,
nest-ai-tokens and nest-queue.

nest-auth's own CHANGELOG entry is deliberately left alone — it names the old address as
the thing that was removed, which is a record of what happened rather than an instruction
to anyone.

Verification

pnpm check:published passes: README links resolve, internal anchors match real headings,
and every snippet still compiles against dist/.

[Copilot]

🟢 Ready to approve

The changes are consistent, scoped to documentation/planning content, and repository-wide searches show no remaining references to the old security@bymax.one address.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Updates documentation/planning references so vulnerability disclosures point to a monitored mailbox (support@bymax.one) instead of a non-existent address, aligning this repo with the portfolio-wide security contact convention.

Changes:

• Replace the security contact address in Phase 5 release task acceptance criteria and verification steps.
• Update the same security contact reference in the development plan deliverables section.
• Reformat a TypeScript union type example in docs/development_plan.md for brevity.

File summaries

File	Description
docs/tasks/phase-05-release.md	Updates SECURITY.md acceptance criteria, deliverables, and verification to reference support@bymax.one.
docs/development_plan.md	Updates the SECURITY.md guidance line to support@bymax.one and condenses a union type example line.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.