Report security issues privately. Do not open public GitHub issues for exploitable bugs involving:
- Jellyfin auth/session handling
- plugin-side proxying of private URLs
- API key exposure
- unsafe download dispatch behavior
Until a dedicated disclosure address exists, report privately to the repository maintainers.