Security

The security policy lives at the repository root (SECURITY.md) — trust model, supported versions, and how to report a vulnerability.