Security fixes are applied to the latest minor release.

Please report vulnerabilities privately by opening a security advisory in the repository security tab.

Include:

• Affected version and environment.
• Reproduction steps.
• Impact assessment.
• Suggested remediation if known.

Do not disclose vulnerabilities publicly until maintainers confirm remediation and disclosure timing.

• Default deny policy enforcement.
• Least privilege capabilities.
• Immutable audit chain.
• Secret redaction in logs and audit payloads.