Do not report vulnerabilities in a public issue.

Use GitHub private vulnerability reporting for this repository. Include the affected version or commit, impact, reproduction steps, and any suggested fix.

Security fixes are made against the latest code on main.