Use Report a vulnerability under the affected repository's Security tab. For specification vulnerabilities, use the ans-spec reporting form. For this repository, use private reporting.

Include the affected version, reproduction steps, impact, and any proposed fix. Do not post vulnerability details or credentials in a public issue, PR or chat. Repository administrators receive the report and coordinate privately with the relevant Maintainers. Follow supported-version guidance in the affected repo; the default supported line is its latest minor release.