This is the organization-wide default. If the repository you're looking at has its own SECURITY.md, that one applies instead — check there first for repo-specific supported-version and architecture-scope details.

1. Do not open a public issue for a security vulnerability.
2. Use GitHub's private security advisory feature on the specific repository, or email the maintainers directly (see that repo's MAINTAINERS.md).
3. Include a clear description, reproduction steps, and the scope of impact.
4. Expect acknowledgement within 48 hours.

For the core engine's full security model — sandboxing, data modes, the trust layer — see Wizard-AIA/Wizard-w2's SECURITY.md.