If you discover a security vulnerability in any Gilamonster Foundation repository, please report it responsibly.

Do NOT open a public issue. Instead:

1. Email shawn.hartsock@gmail.com with:
   • A description of the vulnerability
   • Steps to reproduce
   • Potential impact
2. You will receive an acknowledgment within 48 hours.
3. We will work with you to understand and address the issue before any public disclosure.

This policy applies to all repositories under the Gilamonster-Foundation GitHub organization.

All repositories in this org enforce:

• GitHub secret scanning with push protection
• Dependabot alerts and security updates
• CI safety gates that scan for leaked secrets and forbidden patterns
• Branch protection on main requiring PR reviews and passing checks