If you discover a security vulnerability in Mandol, please report it by emailing the maintainers directly. Please do not file a public issue.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

We aim to acknowledge security reports within 48 hours and provide a substantive response within 7 days.

• Never commit API keys, passwords, or other secrets to the repository
• Use environment variables for sensitive configuration
• Keep dependencies up to date
• Report any suspicious behavior