Attacking the trust plane deliberately? docs/security-review-kit.md is the rules of engagement: which target to use, how to provision your own credentials, the invariants a finding has to break, and the limits that are already documented in SECURITY_LIMITATIONS.md.

If you discover a security issue:

1. Do not disclose it publicly in Issues or Discussions.
2. Open a private security advisory in GitHub (preferred).
3. If advisory flow is unavailable, open an issue with minimal details and request private contact.

Include:

• affected endpoint(s)
• reproduction steps
• impact assessment
• proposed mitigation (if available)

• Initial triage target: within 5 business days
• Remediation timeline: based on severity and exploitability
• Credit: provided upon request after a fix is published