If you discover a security vulnerability:

1. DO NOT create a public GitHub Issue
2. DO NOT discuss publicly
3. Email: n.s.evteev@ya.ru
4. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: within 24 hours
• Initial assessment: within 3 business days
• Fix timeline: depends on severity (Critical: 7 days, High: 14 days, Medium: 30 days)

Security updates are released as patch versions.