Report vulnerabilities to security@missivus.com. Please do not open a public issue until a fix is out.

The standing security review — what is enforced, what is verified, and which risks are accepted with reasons — lives in docs/SECURITY.md.