Report security issues privately to security@ark.computer (placeholder until domain is registered).

We aim to:

• Acknowledge receipt within 5 business days.
• Provide a fix or mitigation within 30 days for confirmed issues.
• Coordinate public disclosure within 90 days of the initial report.

Only the latest tagged release receives security updates.