SPA (Super Phat Arrow) on Nostr: You don't have a `SECURITY.md` for responsible disclosure so not sure