Please do not report security vulnerabilities via public GitHub issues.

Send a private report to support@juggle.im with:

• A clear description of the issue and its impact
• Steps to reproduce
• Affected versions
• (Optional) Suggested fix or PoC

We aim to acknowledge reports within 48 hours and provide a fix timeline within 7 days for critical issues.

A public advisory will be published after a patch is released, with full credit to the reporter (unless anonymity is preferred).