Report security issues against the latest main branch.

Open a private security advisory on this GitHub repo when possible. If that is unavailable, open a normal Issue with title prefix [security] and omit exploit details until maintainers reply.

Do not post credentials, tokens, or customer data in public Issues.