If you discover a security vulnerability, please report it responsibly:

1. Do not open a public GitHub issue.
2. Email the maintainers with a description of the vulnerability.
3. Include steps to reproduce the issue if possible.

We will acknowledge receipt within 48 hours and provide a timeline for a fix.

This project uses Dependabot to monitor dependencies for known vulnerabilities. The CI pipeline includes pip-audit and bandit scans.