Report suspected security vulnerabilities through the project issue queue using Drupal.org security reporting guidance when available. Do not include secrets, private URLs, or exploit payloads in public issues.

Third-party dependency risk is reviewed with:

• composer audit during release preparation and CI where available.
• Drupal Security Advisories for Drupal core and contributed dependencies.
• GuzzleHTTP and Symfony security advisories for outbound HTTP and HTML parsing dependencies.

Do not expose VCS metadata from the web root in production. Keep .git directories out of deployed artifacts where possible, or configure the web server to deny access to dotfiles and dot-directories.