See docs/SECURITY.md for the current security posture, known limitations, safe handling rules, and private reporting guidance.