Report vulnerabilities through GitHub private vulnerability reporting or the organization security contact. Do not disclose exploit details publicly before maintainers confirm impact and a remediation path.

This repository handles numerical package code, native/WASM backend paths, benchmark artifacts, and npm release credentials through CI. Security-sensitive changes require relevant tests, benchmark evidence when performance or native paths are affected, and package-publication readback after any future npm release.