Please do not report suspected vulnerabilities in public issues. Contact the repository maintainer privately with a minimal reproduction, affected version, and any relevant impact details.