If you discover a vulnerability, please avoid public disclosure.

• Open a private security advisory on GitHub, or
• Email: security@a1reactor.example (replace with your contact)

Include reproduction steps and expected impact.