Report security issues to the repository's Security contact on GitHub.

Guidelines
- Do not publicly disclose vulnerabilities before a fix is available.
- We aim to acknowledge reports within 72 hours and provide a timeline for remediation.

Local checks
- Run `pnpm audit` to list advisories.
- Use `pnpm audit --json` in CI to programmatically fail on high/critical advisories.