Vulnerability disclosure

Report suspected vulnerabilities privately through the configured security contact placeholder in SECURITY.md. Include affected area, reproduction steps, impact, and safe evidence. Do not include secrets or customer data. SaaS will acknowledge receipt, triage severity, coordinate a fix, and provide a status update. Testing production, third-party providers, or infrastructure without written authorization is prohibited.