Report suspected vulnerabilities privately through GitHub private vulnerability reporting.

Do not open a public issue with exploit details, credentials, recordings, transcripts, or other sensitive data.

Reports for the current main branch are in scope. Include a minimal reproduction, affected version or commit, impact, and mitigation ideas when available.