Refer to FOUNDATION/POLICIES/SECURITY.md and FOUNDATION/POLICIES/RESPONSIBLE_DISCLOSURE.md for complete security and disclosure policies.

Report vulnerabilities to: security@mobius.systems

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested mitigation (if any)

We will respond within 7 days and work with you on coordinated disclosure (90-day window).

1. Private report received
2. Triage (≤7 days)
3. Fix development (≤90 days)
4. Coordinated release and advisory
5. Public disclosure

Critical vulnerabilities may trigger emergency releases and safe-stop procedures.

To be published upon Foundation formation