Please report suspected vulnerabilities privately to the repository owner rather than opening a public issue. Include a clear reproduction, affected version or commit, and impact assessment where possible.