Please report security issues privately — do not open a public issue.

Use GitHub's private vulnerability reporting: go to the repository's Security tab and click Report a vulnerability.

When reporting, please include:

• A description of the issue and its potential impact.
• Steps to reproduce or a proof of concept.
• Affected version(s) and environment.

• We aim to acknowledge reports within a few business days.
• We will keep you informed as we investigate and work on a fix.
• We will credit you in the release notes once the issue is resolved, unless you prefer to remain anonymous.