Please do not open a public issue for security vulnerabilities.

Instead, report it privately through GitHub's private vulnerability reporting (Security → Report a vulnerability). If that is unavailable, contact the maintainers directly.

Please include enough detail to reproduce the issue (affected component, steps, and impact). We will acknowledge your report, keep you updated on progress, and credit you in the fix unless you prefer to remain anonymous.