Do not report security-sensitive issues through public GitHub Discussions, Issues, or pull requests.

Report a suspected vulnerability privately to [email protected]. Include a concise description, affected files or components, reproduction steps when safe to share, and any known impact. Maintainers will acknowledge the report and coordinate a private response.