Please do not report security vulnerabilities in public issues.

Use GitHub's private vulnerability reporting flow ("Report a vulnerability" in the repository Security tab). If private reporting is unavailable, contact a maintainer directly via GitHub.

When reporting, include:

1. A clear description of the issue and impact.
2. Steps to reproduce or a proof of concept.
3. Affected paths/files and suggested mitigation (if known).

We will acknowledge valid reports, investigate, and work on a fix as quickly as possible.