Please report suspected vulnerabilities privately using GitHub's private vulnerability reporting on this repository (Security tab → "Report a vulnerability"). Do not open a public issue, pull request or discussion for an undisclosed vulnerability.

Include, when possible:

• affected version or commit
• a description of the issue and its security impact
• steps to reproduce or a proof of concept
• suggested mitigation, if you have one

You will receive an acknowledgement within 72 hours. We will keep you informed of the triage outcome and coordinate a fix and disclosure timeline with you. Credit in the release notes is given unless you prefer otherwise.

Security fixes are applied to the latest release on main; older releases are not patched retroactively.