This repository is actively maintained on the main branch.

If you believe you have found:

• a secret or private data leak
• a boundary check bypass
• a security issue in the public release surface

please report it privately instead of opening a public issue.

Include:

• a short description of the problem
• the affected path or command
• the steps you used to reproduce it
• whether the issue could expose private information

Do not include secrets, access tokens, or private paths in reports unless they are required to demonstrate the problem. If they are required, redact them as much as possible.