⚠️ The “v2” documents amend a v1 baseline that is not yet in this repository (pending imports). Where a v2 document is silent on a topic, the missing v1 rule still applies — ask rather than assume.
security.md currently holds only the amendments set; it must be merged with the v1 security
standard once that is imported.