Please do not open a public issue for vulnerabilities that could expose credentials, private data, authentication bypasses, remote code execution, destructive actions or other security-sensitive behavior.
For security reports, contact the maintainer privately through the contact route at:
Include:
- affected repository and version
- reproduction steps
- realistic impact
- logs or proof of concept where safe
- any suggested mitigation
Please avoid accessing data that is not yours, disrupting services, or publishing exploitation details before a fix is available.