Use GitHub's private vulnerability reporting to report security issues confidentially. Do not open public issues for security vulnerabilities.

We aim to acknowledge vulnerability reports within 3 business days and provide a status update within 14 days. Please allow up to 90 days for investigation, remediation, and coordinated disclosure before publishing details. Critical vulnerabilities may be disclosed and fixed sooner when users face active risk.