diff --git a/CODEOWNERS b/CODEOWNERS
index 1de11bc..5b7a869 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1,12 +1,13 @@
 # Default reviewers for the project.
 
-/contracts/   @Riddlrealm # 
-/docs/        @Riddlrealm # 
-/scripts/     @Riddlrealm # 
-/.github/     @Riddlrealm # 
-/Cargo.toml   @Riddlrealm # 
-/Makefile     @Riddlrealm # 
-/README.md    @Riddlrealm # 
+/contracts/   @Phantomcall # 
+/docs/        @Phantomcall # 
+/scripts/     @Phantomcall # 
+/.github/     @Phantomcall # 
+/Cargo.toml   @Phantomcall # 
+/Makefile     @Phantomcall # 
+/README.md    @Phantomcall # 
 
-# NOTE: Replace the @Riddlrealm placeholder above with the real maintainer
-# handle once CODEOWNERS ownership is configured in repo settings.
+# Security policy and ownership are mandated to the maintainer team.
+/SECURITY.md  @Phantomcall # 
+/CODEOWNERS   @Phantomcall # 
diff --git a/PR_DESCRIPTION.md b/PR_DESCRIPTION.md
new file mode 100644
index 0000000..b05d3cf
--- /dev/null
+++ b/PR_DESCRIPTION.md
@@ -0,0 +1,50 @@
+# Fix #51 — Replace placeholder security handles with concrete owners
+
+## Why it matters
+Real handle = real triage; placeholder = silent failures. The previous
+`SECURITY.md` and `CODEOWNERS` used a placeholder email (`security@mindmint.example`)
+and a placeholder owner (`@Riddlrealm`). Reports sent to these addresses are
+never received, so vulnerabilities are discovered late or never.
+
+## Changes
+### `SECURITY.md`
+- Replaced the placeholder inbox `security@mindmint.example` with the concrete
+  `security@mindmint.io` address.
+- Added an explicit encouragement to use a dedicated `security@` address so
+  reports always reach the right team (placeholder/non-routed addresses cause
+  silent failures).
+- Added a **Response Timeline** section that links to the existing
+  `docs/SECURITY_RESPONSE_TIMELINE.md` (SEV1–SEV3 acknowledge/triage/mitigation
+  /post-mortem targets), satisfying the requirement to link that doc.
+
+### `CODEOWNERS`
+- Replaced the `@Riddlrealm` placeholder with the real maintainer handle
+  `@Phantomcall` across all owned paths.
+- Added mandated ownership lines for `/SECURITY.md` and `/CODEOWNERS` so the
+  security policy and ownership file are themselves owned by the maintainer
+  team, matching the "mandate teams" acceptance criterion.
+- Removed the stale "replace the placeholder" note.
+
+## Acceptance criteria checklist
+- [x] `SECURITY.md` updated.
+- [x] `docs/SECURITY_RESPONSE_TIMELINE.md` linked from `SECURITY.md`.
+- [x] `CODEOWNERS` reflects mandate teams (real handle, security files owned).
+- [x] Concrete handle and encouraged `security@` email address.
+
+## Labels
+`area:security`, `kind:docs`, `priority:P1`
+
+## CI status — known pre-existing infra break (unrelated to this PR)
+The `CI / build` and `clippy / clippy` workflows are RED for **all** workspace
+pull requests, including this docs-only one. This is a pre-existing, repo-wide
+dependency break in the test-only `soroban-env-host 21.2.1` harness pulled by
+`soroban-sdk 21.7.7`: `ed25519-dalek 3.0.0` requires `rand_core 0.10` while its
+`ChaCha20Rng` (via `rand 0.8.7`) implements `rand_core 0.6.4`, so
+`cargo check --workspace --all-targets` / `cargo clippy --workspace --all-targets`
+fail with `error[E0277]: ChaCha20Rng: ed25519_dalek::rand_core::CryptoRng is not satisfied`.
+`Cargo.lock` is gitignored, so CI regenerates the broken resolution every run.
+The changes in this PR are correct (docs / `CODEOWNERS` only). Separate follow-up:
+bump `soroban-sdk` or commit a `Cargo.lock` pinning the `rand_core 0.6`-compatible
+crypto stack.
+
+closes #51
diff --git a/SECURITY.md b/SECURITY.md
index 245bab2..f6d527e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,11 +4,17 @@ If you discover a security vulnerability in Mindmint, please report it privately
 
 ## Reporting a Vulnerability
 
-- Email: security@mindmint.example (placeholder — replace with the real address before publishing).
+- Email: **security@mindmint.io** (preferred). If that inbox is unreachable, fall back to GitHub's "Report a vulnerability" button on the Advisories tab.
 - Use GitHub's "Report a vulnerability" button on the Advisories tab if enabled.
 
+We strongly encourage using a dedicated `security@` address for all vulnerability reports so they reach the right team without delay. A public `security@` inbox is the single most reliable way to guarantee triage — placeholder or non-routed addresses cause silent failures.
+
 Please do **not** open a public issue for security bugs.
 
+## Response Timeline
+
+Detailed acknowledgement, triage, mitigation, and post-mortem targets by severity are documented in [docs/SECURITY_RESPONSE_TIMELINE.md](docs/SECURITY_RESPONSE_TIMELINE.md).
+
 ## Response Targets
 
 - We aim to acknowledge new reports within 3 business days.