security policy Report vulnerabilities via GitHub Security Advisories. No telemetry or network calls at runtime.