Please do not report suspected vulnerabilities in public issues.

Use GitHub vulnerability reporting for the repository when it is enabled. If it is not enabled, contact the maintainers through the project's published support channel and include:

• Affected version or commit.
• Clear reproduction steps.
• Impact and affected data or permissions.
• Any logs or proof of concept needed to verify the issue, with secrets redacted.

We will acknowledge valid reports as soon as practical and coordinate fixes before public disclosure.