The canonical disclosure policy and STRIDE threat model live in the documentation repo:

• Disclosure policy
• Threat model
• Operator-facing security model

Email security@simtabi.com. Do not open a public GitHub issue. Acknowledgement within 48 hours, patch SLA per severity in the canonical policy.