If you discover a security vulnerability in BEAM, please report it responsibly:

1. Preferred: Use GitHub's private vulnerability reporting feature (Security tab → "Report a vulnerability")
2. Alternative: Email david.r.newman@proton.me

Please do not open a public GitHub issue for security vulnerabilities.

• Acknowledgment: Within 72 hours
• Assessment: Within 7 days
• Fix for critical issues: Within 30 days
• Disclosure: After fix is released, or 90 days from report (whichever is sooner)

• Dependency advisories monitored via cargo-audit and cargo-deny
• All releases pass cargo audit before publishing
• CI enforces clippy -D warnings and zero compiler warnings