Report vulnerabilities privately via GitHub: Security → Report a vulnerability on this repo.

Include: description, reproduction steps, affected versions, and impact. We aim to respond within 7 days.

Do not open a public issue for security vulnerabilities.