SECURITY.md
```markdown
If you discover a security issue, please open a private report (GitHub Security Advisory). Avoid posting exploit details publicly until a fix is available.