Report security vulnerabilities privately, not through a public issue or pull request.

Prefer opening a private vulnerability report on GitHub. Alternatively, email [email protected].

Include the affected version, a description of the issue, and reproduction steps or a proof of concept if available.