Please do not report security vulnerabilities in a public issue.

Use GitHub private vulnerability reporting to share the affected repository, impact, reproduction steps, and any suggested mitigation. A maintainer will acknowledge the report as soon as practical and keep you updated while it is investigated.

For dependency vulnerabilities, include the package name and affected version when known. Do not include real credentials, personal data, or destructive proof-of-concept payloads in a report.