This is a response guide. No code to exploit, two things worth reporting fast anyway.

Guidance that would make someone's incident worse. These pages get followed under pressure, so a wrong sequence, a bad legal instinct, or a dangerous default here fires on somebody's worst day. If you spot one, open an issue, it jumps the queue ahead of everything.

Anything that looks like a real incident with the names filed off. Nothing here should come from a client engagement or describe a recognizable event. If something does, do not open a public issue. Use GitHub's private vulnerability report on this repo, or the contact on my profile, and it gets handled quietly and quickly.

No bounty program. The reward is a calmer 6am for somebody you will never meet.