This repository is governed as an engineering documentation and automation workspace. Security review applies to source code, generated artifacts, workflows, governance records, and documentation that affects operational or release decisions.

Do not disclose suspected vulnerabilities in public issues or pull requests. Report security concerns to the repository owner or designated maintainer through a private channel. Include:

• A concise description of the concern.
• Affected files, workflows, or generated artifacts.
• Steps to reproduce or inspect the issue.
• Potential impact and any known mitigations.

Maintainers should acknowledge reports, classify severity, assign an owner, and record remediation evidence. Security-sensitive fixes should preserve traceability while avoiding disclosure of exploit details before mitigation.

Security-relevant changes should reference the applicable RTM entry, ADR, DMAIC phase, or governance control when available.