If you discover a security vulnerability, please report it privately:

1. DO NOT create a public GitHub issue
2. Email: [security contact needed]
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• 24 hours: Initial response acknowledging receipt
• 72 hours: Initial assessment and severity classification
• 7 days: Detailed response with fix timeline

When contributing:

• Always validate inputs
• Use proper authentication checks
• Follow principle of least privilege
• Test edge cases and error conditions
• Review code for potential vulnerabilities