Please report security vulnerabilities through GitHub private vulnerability reporting.

Do not open a public issue for an unpatched vulnerability. Private reports let us investigate, prepare a fix, and coordinate disclosure without exposing users before a fix is available.

Please include the affected version or commit, reproduction steps, impact, and any suggested mitigation. We will acknowledge a report as soon as practical and keep the report updated while it is being investigated.