Do not open a public issue for a suspected vulnerability. Submit a private report through GitHub Security Advisories with reproduction steps, impact, and any suggested mitigation.

Maintainers must enable GitHub's Private vulnerability reporting before public release so reports can be submitted by people without repository write access.

This policy covers the mobile application, release workflow, and repository configuration.