Report potential vulnerabilities to security@your-org.example (coordinated disclosure). No stealth, no self-update, no hidden persistence.