If you discover a security issue, please do not open a public issue. Instead:

1. Email shane@fellwork.com with the details.
2. Use the subject line [security] <repo-name>: <one-line description>.
3. Include reproduction steps, affected versions, and any mitigation you've considered.

We aim to acknowledge within 2 business days and patch critical issues within 14 days.

Only the latest released version receives security updates.