Please do not open a public GitHub issue for security vulnerabilities.

Instead, email the maintainer at the address listed in package.json (author field) or use GitHub's private vulnerability reporting if enabled.

Include:

• Description of the issue
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

We aim to acknowledge reports within 7 days.

This policy covers the editable.ts library published to npm (lib/, dist/). The demo site at GitHub Pages is out of scope for library vulnerabilities unless they expose users of the npm package.