Vulnerability Disclosure
Report to the founder address; acknowledgement is committed, retaliation is not a thing here, and findings enter the same register everything else does.
Draft status: counsel-ready, effective at general availability. The exact compliance posture is Independently verifiable audit chain; the harness that proves it ships with the product.