Security Policy Report privately via GitHub security advisories. Local-first stack: no cloud data paths.