Add Threat Model; route vulnerability reports to private disclosure (#269) New structured Threat-Model page (boundary, trusted/untrusted surfaces, sinks, the DoS-not-RCE guarantee, and the is-this-a-security-bug test). Security and Reporting-Bugs now send suspected vulnerabilities to GitHub private reporting / SECURITY.md instead of a public issue; sidebar links the new page.
Reporting Bugs: file via GitHub with the simplest reproducing .docx; label and severity definitions Linked from the sidebar, the Home navigation table, the Developers filing section and the Security reporting section. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfLh84M9sga4pBc2iqHV5o