If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public GitHub issue
2. Email: security@artificialpaper.dev
3. Include: description, reproduction steps, impact assessment
4. Expected response time: 48 hours

• API keys validated with hmac.compare_digest (constant-time)
• JWT tokens verified with algorithm pinning (no alg=none)
• AES-256-GCM encryption for secrets at rest
• bcrypt with cost factor 12 for password hashing
• Input sanitization against injection attacks
• No secrets in logs (SecretString type with masked __repr__)
• All gRPC channels support TLS