Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report it privately through one of these channels:

• Email security@hivecommons.dev — the contact published in the organization's security.txt.
• GitHub private vulnerability reporting, if it is enabled for this repository: Security tab → Report a vulnerability.
• Otherwise, contact a repository maintainer directly (see the maintainers listed on the hivecommons organization).

Please include:

• The affected component and the commit or published npm version.
• A description of the issue and its potential impact.
• Steps to reproduce, with any proof-of-concept or logs.

We aim to acknowledge reports within 5 business days, investigate, and coordinate a fix and disclosure timeline with you. Please allow a reasonable time to remediate before public disclosure.