Report vulnerabilities privately through GitHub security reporting when available. Do not publish exploitable details, credentials or private data in public issues.

Include the affected version, component, reproduction steps and impact when safe. Bundled FFmpeg and other third-party components may have their own security advisories.