Do not open a public issue for a suspected vulnerability. Follow the Zcash Foundation's security policy to report it privately, and include the affected action commit, workflow permissions, and the smallest reproduction you can provide.

Before the first stable release, only the latest commit on the default branch receives security fixes. Consumers should pin an audited full commit SHA and use Dependabot to propose updates.