Describe a situation where you discovered a security or privacy issue late in development. How did you escalate, remediate, and ensure the fix didn't compromise product timelines?