Pepsy is scientific Python software and does not provide a network service. Please do not disclose a suspected security issue in a public issue or pull request before maintainers have had an opportunity to assess it.

Report security concerns privately to the repository maintainers through the organization's security reporting channel. Include the affected version, Python/backend environment, a minimal reproduction, and the impact you observed. Do not include credentials, private data, or unpublished research inputs.

Dependency vulnerabilities should identify the package, affected version, and the smallest reproducible installation profile.