If you discover a security vulnerability, please report it privately through GitHub's Private vulnerability reporting.

Do not open a public issue.

You can expect:

• An initial acknowledgement within 8 hours
• A preliminary assessment within 24 hours
• A fix or mitigation plan communicated as soon as it's ready

Confirmed vulnerabilities will be publicly credited to the reporter after a fix is released, unless you prefer to remain anonymous.