If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue
2. Create a GitHub Security Advisory
3. Include: description, reproduction steps, and potential impact

We aim to acknowledge reports within 48 hours and provide a fix timeline within 7 days.

silly-kicks is a pure computation library — it does not:

• Open network connections
• Read/write files
• Execute subprocess commands
• Deserialize untrusted data (no pickle, no yaml.load)

The primary security surface is input validation on provider DataFrames, which is enforced via _validate_input_columns() at every converter entry point.