Vulnerability reporting policy scored to Scorecard Security-Policy 10/10:
contact email, canonical repo URL with https://, response process, and
a supported-versions table reflecting the actual v1.1.0 tag (only 1.x
line exists). No docs/support-period.md or SBOM claims — neither exists
in this repo.
