Please do not disclose security vulnerabilities in a public issue.

Use GitHub private vulnerability reporting when possible. Include a clear description, reproduction steps, affected versions, and any suggested mitigation. Do not include real API keys, private audio, or unredacted transcripts.

We will acknowledge valid reports and coordinate a fix before public disclosure.