Do not open a public issue for a suspected vulnerability or exposed secret. Use GitHub private vulnerability reporting instead.

Include the affected version, impact, reproduction steps, and any suggested mitigation. Please avoid including real credentials, personal data, or unrelated third-party content. We will acknowledge a report as soon as practical and coordinate disclosure after a fix is available.

Only the latest published release receives security fixes during the initial 0.x development period.