Responsible disclosure
A monitored security contact and a standards-aligned security.txt record are launch requirements. Until those contact details are configured, do not transmit sensitive vulnerability information through a public form.
Platform controls
The production plan includes authenticated administration, MFA, least-privilege access, protected uploads, backups, rate limits, security headers, monitored dependencies and incident procedures.
Reporting a concern
The final security policy will provide a verified reporting channel, scope, safe-harbour language and expected acknowledgement route after domain and contact configuration are complete.