Please report suspected vulnerabilities privately to [email protected]. Include a clear reproduction, affected version, and potential impact. Do not publish an exploit before a fix is available.