Report issues privately via GitHub security advisories.

Include steps to reproduce and impact. Do not open public issues for security reports.

In scope: privilege escalation, command injection, secret leaks, unsafe system calls.

Out of scope: Fedora, systemd, containers, third-party tools — report to upstream.

Timeline: 5 days to acknowledge, 30 days to fix. Prefer coordinated disclosure.