Please do not open public issues for security vulnerabilities.

Instead:

1. Open a GitHub Security Advisory if available.
2. Contact the maintainers privately.
3. Provide:
   • A description of the vulnerability
   • Steps to reproduce
   • Impact assessment
   • Suggested mitigation (if known)

Security reports will be:

1. Acknowledged as soon as possible.
2. Investigated privately.
3. Fixed and patched before public disclosure when feasible.
4. Credited responsibly unless anonymity is requested.

This policy covers:

• Documentation rendering
• Markdown parsing
• HTML rendering
• Navigation and routing
• Client-side assets
• Build and deployment workflows

Third-party dependencies are covered only to the extent that updates or mitigations can be applied by project maintainers.